Anthropic Claude Sonnet 4.5 Demonstrates Autonomous Multi‑Stage Attacks Using Only Open‑Source Tools

TL;DR

Claude Sonnet 4.5 can now execute multi‑stage network attacks and exfiltrate simulated personal data from an Equifax‑style breach using only standard Bash commands on a Kali Linux host, showing that AI models no longer require custom cyber toolkits to succeed in realistic cyber‑range environments.

1. Overview of the Announcement

Anthropic released an update on Jan 16 2026 describing a new capability of its Claude Sonnet 4.5 model:

"In a recent evaluation of AI models’ cyber capabilities, current Claude models can now succeed at multistage attacks on networks with dozens of hosts using only standard, open-source tools, instead of the custom tools needed by previous generations."

The announcement builds on a 2025 paper that evaluated Claude on Carnegie Mellon University’s CyLab cyber ranges, which are more sophisticated than typical capture‑the‑flag environments. The key advance is that Sonnet 4.5 can succeed without the custom cyber‑toolkit that earlier models required.

2. Technical Progress Since the Last Evaluation

Model Release Need for Custom Toolkit Success on Equifax Simulation
Claude Sonnet 3.5 2024‑2025 Required 0 / 5 trials
Claude Sonnet 4.5 2026 Not required for a minority of networks; still needed on 5 / 9 networks 2 / 5 trials (autonomous)

The trajectory mirrors other AI progress trends: models first rely on specialized scaffolding and later become capable of operating with only publicly available tools.

3. Equifax‑Style Breach Simulation Details

The evaluation recreated the 2017 Equifax breach, which exploited a public CVE that had not yet been patched. Sonnet 4.5 demonstrated the following steps using only a Bash shell on a Kali Linux host:

  1. Vulnerability Recognition – Instantly identified the publicized CVE without external lookup.
  2. Exploit Generation – Wrote exploit code on the fly.
  3. Data Exfiltration – Pulled all simulated personal information from the target system.

"Sonnet 4.5 can now exfiltrate all of the (simulated) personal information in a high‑fidelity simulation of the Equifax data breach… using only a Bash shell on a widely‑available Kali Linux host (standard, open‑source tools for penetration testing; not a custom toolkit)."

The model achieved autonomous success in two of five trials, illustrating both the promise and the variability of current AI‑driven attack automation.

4. Limitations and Success Rate

  • Partial Success – Sonnet 4.5 succeeded autonomously on 2 / 5 Equifax trials and could not progress on 5 / 9 other networks without the custom toolkit.
  • Dependence on Network Conditions – The model still requires a reachable vulnerable service and appropriate credentials; it does not guarantee success on every target.
  • Tool Availability – While the demonstration used only Bash and Kali utilities, more complex environments may still necessitate additional tooling.

These caveats are explicitly acknowledged by Anthropic:

"It’s important not to overstate the status quo. Claude does not succeed every time in these tests; Sonnet 4.5 succeeded autonomously on the Equifax cyber range in two of five trials. Also, for five of the nine networks it could not make progress without the custom cyber toolkit."

5. Broader Implications

5.1 Lowered Barriers for AI‑Powered Cyber Attacks

The ability to conduct sophisticated attacks with only standard, open‑source tools means that non‑technical actors could leverage AI models to automate large‑scale exploitation. The speed at which the model recognized a public CVE and generated an exploit underscores the risk of rapid, automated weaponization of known vulnerabilities.

5.2 Importance of Basic Security Hygiene

Anthropic emphasizes that the Equifax‑style scenario highlights a timeless defensive principle:

"The prospect of highly competent and fast AI agents leveraging this approach underscores the pressing need for security best practices like prompt updates and patches."

Keeping systems patched against publicly disclosed CVEs is now more critical than ever because AI can instantly discover and exploit them.

5.3 Need for Defensive AI Research

The post references Anthropic’s own work on AI‑enabled cyber defenders:

"...real‑world examples like the recent AI‑orchestrated cyber espionage campaign... show the need for substantial research into how best to equip cyber defenders with the AI‑enabled tools they will need to keep pace."

Developing defensive AI that can detect, contain, and remediate AI‑driven attacks is a priority.

6. Recommendations for Practitioners

  1. Patch Management – Accelerate patch deployment pipelines to close known CVEs before AI agents can exploit them.
  2. Network Segmentation – Isolate critical assets (e.g., databases) to limit lateral movement opportunities.
  3. Monitoring for Anomalous Tool Use – Deploy detection rules for typical penetration‑testing utilities (e.g., curl with suspicious payloads) being used from unexpected hosts.
  4. Invest in Defensive AI – Explore AI‑driven threat‑hunting and automated response platforms that can match the speed of offensive AI.
  5. Red‑Team Exercises with AI – Incorporate AI‑augmented adversaries into penetration‑testing engagements to surface novel attack paths.

7. Where to Find More Information

8. Conclusion

Anthropic’s latest evaluation shows that Claude Sonnet 4.5 can autonomously execute multi‑stage attacks and exfiltrate data from a realistic Equifax‑style breach using only standard Bash commands on Kali Linux. This marks a significant step forward in AI‑driven offensive capabilities and reinforces the urgency of robust patch management, network segmentation, and the development of AI‑powered defensive tools.

Sources

Related