Last month, at the 33rd annual DEF CON, the world’s largest hacker convention, in Las Vegas, Anthropic researcher Keane Lucas took the stage. A former U.S. Air Force captain with a PhD in electrical and computer engineering from Carnegie Mellon, Lucas wasn’t there to unveil flashy cybersecurity exploits. Instead, he showed how Claude, Anthropic’s family of large language models, has quietly outperformed many human competitors in hacking contests—the kind used to train and test cybersecurity skills in a safe, legal environment. His talk highlighted not only Claude’s surprising wins but also its humorous failures, like drifting into musings on security philosophy when overwhelmed, or inventing fake “flags” (the secret codes competitors need to steal and submit to contest judges to prove they’ve successfully hacked a system).
Lucas wasn’t just trying to get a laugh, though. He wanted to show that AI agents are already more capable at simulated cyberattacks than many in the cybersecurity world realize—they are fast, and make good use of autonomy and tools. That makes them a potential tool for criminal hackers or state actors—and means, he argued, that those same tools need to be deployed for defense.
