The rail industry faces many challenges with cyber security being one. With everything being increasingly connected, cyber security applies to all engineering disciplines and the risk of breaches could dramatically increase following the release of Claude Mythos.
Claude Mythos is a very advanced AI cyber model which can find vulnerabilities in many systems – including those used in rail – very quickly and cost effectively. It has only been released to the ‘good guys’ in order to help fix their systems, but what happens if it falls into the hands of ‘bad actors’, or they develop their own AI cyber-attack tools?
The system has been developed by Anthropic, a research body with the objective of investigating the safety, operation, and societal impacts of AI. Claude Mythos has been withheld from public release due to its unprecedented ability to find and exploit software vulnerabilities. Vulnerabilities in software systems means weaknesses or faults which allow security breaches.
In the software and cyber security industries these are known as zero-day vulnerabilities. They are security flaws that are unknown and which can be in place for years. Zero-day vulnerabilities are very dangerous because they can be exploited by attackers before the vendor becomes aware of the issue and has any opportunity to fix the problem. It has been established that Claude Mythos is capable of quickly and cheaply identifying and exploiting zero-day vulnerabilities in every major operating system and browser. The vulnerabilities it finds are often subtle or difficult to detect. Many of them are 10 or 20 years old, with the oldest found so far being a now-patched 27-year-old bug in OpenBSD, a security operating system.
It has been reported that it has discovered thousands of zero-day vulnerabilities in systems, without human intervention beyond an initial prompt, and generated working breaches. The cost-per-finding is reported to be under £40.
Zero-day
Zero-day attacks can be used to disrupt operations, install malware, or obtain data. Even publicly known vulnerabilities can be dangerous for an extended period, as security patches can take months to develop and deploy. The rail industry is at particular risk as it has many old applications and is not known for moving quickly on some issues.
Outside of rail, examples of zero-day exploits include the Stuxnet worm, which used four zero-day vulnerabilities to damage Iran’s nuclear programme in 2010. More recent examples include the SolarWinds hack in 2020 and the ProxyLogon attack on Microsoft Exchange Server in 2021. In 2022, spyware Pegasus was found to exploit zero-click vulnerabilities in messaging services such as iMessage and WhatsApp. These exploits allowed attackers to access users’ devices without even requiring any user interaction.
Claude Mythos, unveiled in April this year, is a general-purpose AI large language model that has extensive capabilities in software coding, analysis, and cyber security. What could take cyber criminals months or years of work to exploit weakness can be achieved overnight. Claude Mythos’s outstanding feature is its ability to quickly and autonomously identify and exploit zero-day vulnerabilities in major operating systems, web browsers, and critical software infrastructure, by chaining them together and bypassing security measures. Users with no formal security training have been able to prompt Claude Mythos to generate fully working exploits overnight.
Project Glasswing
Due to the potential risks of misuse, access to Claude Mythos is restricted through Project Glasswing, a programme involving 12 partners and over 40 organisations responsible for critical software. Confirmed partners include Amazon Web Services, Apple, Google, Microsoft, Nvidia, CrowdStrike, Palo Alto Networks, and the Linux Foundation. Anthropic has also committed $100 million in usage credits and $4 million in donations to open-source security organisations to support defensive cyber security measures.
Understandably, Claude Mythos has raised global security concerns, with governments and financial institutions warning about its potential misuse. Anthropic emphasises that the model’s capabilities could be dangerous if used maliciously, and that the company is working closely with regulators and cyber security experts to ensure it is used responsibly.
In the UK, Ofcom has written to broadband providers to highlight concerns about the “rapid increase in AI ability”, specifically relating to Claude Mythos as representing a fundamental shift to security capabilities. The AI Security Institute, a research organisation within the Department of Science, Innovation and Technology, said Claude Mythos represented “a step up over previous frontier models in a landscape where cyber performance was already rapidly improving”.
When it comes to personal use of applications, operating systems, and browsers, sometimes people do not want to upgrade to the latest release, as they are used to their existing system and do not want to learn yet another version. This can be a big mistake as very often new versions of software are released to fix security vulnerabilities. Similarly, companies and organisations need to be aware of the security risk of an employee or volunteer potentially working on sensitive information on a home IT system, which may not be secure.
Rail
George Bearfield, professor of Railway System Safety at the University of Huddersfield, Institute of Rail Research (IRR) has written a blog on the issue and says that the immediate concern for a Claude Mythos type attack against rail today is not a train accident, but a mass rail outage.
The vulnerable systems are likely to be ticketing systems, passenger information, depot and train fleet maintenance systems, traffic management, workforce management, energy billing, station retail, cloud-hosted applications, and supplier management systems. These are the systems that modern railways have come to depend on and without these the result may be stranded passengers, collapsed timetables, and disruption to maintenance and new works.
Safety signalling systems are understandably a concern, but George says if a week of timetabling is lost to a nationwide ransomware zero days event while the industry is debating exclusively about signalling, then it will have misread the threat.
Railway safety-critical systems such as signalling have structural defences which most of the Claude Mythos type attackers may not have considered. Like with any security measure, attackers will go for the weakest defence. So the safety risk sits slightly downstream of the availability concern of other railway systems. Safety-critical rail systems are built on principles of diversity, redundancy, and fail-safe design, so a vulnerability in a competently engineered interlocking or rolling stock design should not translate directly into safety risk.
George recommends that the rail industry should do three things to manage the Claude Mythos risk:
First, the GB rail sector, working through RSSB, the ORR, DfT, and the NCSC, should be making an urgent, coordinated approach to Anthropic and its peers for defensive access to Claude Mythos. If direct access is not feasible, the next best thing is a rail-sector analogue to be established. Other industry sectors are now moving, and rail should not be debating this for months.
Second, each operator, infrastructure manager and major supplier should urgently produce a clear inventory of the third-party and cloud-hosted systems on which their ability to run services depends, and establish which of those providers are inside the Glasswing programme or its successors.
Third, existing rail cyber risk assessments need to be revisited in light of what is now known about AI-accelerated adversary capability, with an honest output even if its uncomfortable. This is a properly executed risk-based approach. Some safety cases will need supplementing, and some procurement assumptions will also need to change.
Conclusion
Claude Mythos represents a step change in AI capabilities and cyber security. It highlights the dual-use nature of advanced AI, where the same skills that allow for rapid vulnerability detection can also be exploited for attacks. Anthropic’s work and its Project Glasswing strategy aims to give defenders a ‘head start’ while mitigating risks. The rail industry needs to be part of this. Everyone is also encouraged to always ensure their applications, browsers, and operating systems are up to date with the latest releases.
Historically, security measures have benefitted defenders more than attackers. There have been examples where new technology has enabled attackers to identify vulnerabilities at an increased rate, but defenders eventually catch up and sufficiently secure the defences. It is expected that the same will happen with Claude Mythos – eventually. Once the security landscape has caught up, AI language models should benefit defenders more than attackers, increasing the overall security of the software ecosystem.
The advantage will belong to the side that can get the most out of the tools. In the short term, this could be attackers, but in the long term, it is expected that defenders will be more efficient in directing resources, and use AI such as Claude Mythos to fix bugs before new code is deployed. Let’s hope this is the case and that the transitional period is not too disastrous for the rail industry.
Source material can be found here.
Image credit: iStockphoto.com/ATHVision