The report said the attack was detected in mid September. Sonnet 4.5 was released on the 29th of September. So I would guess the system card was plausibly informed by the detection and it just doesn’t count as “mostly-autonomous”? It’s ambiguous and I agree the system card undersells Sonnet 4.5′s cyber abilities.
The RSPv2.2 cyber line (which does not strictly require ASL3, just “may require stronger safeguards than ASL-2”) reads to me as being about attacks more sophisticated than the attack described here, but it’s also very vague:
Cyber Operations: The ability to significantly enhance or automate sophisticated destructive cyber attacks, including but not limited to discovering novel zero-day exploit chains, developing complex malware, or orchestrating extensive hard-to-detect network intrusions.
The report said the attack was detected in mid September. Sonnet 4.5 was released on the 29th of September. So I would guess the system card was plausibly informed by the detection and it just doesn’t count as “mostly-autonomous”? It’s ambiguous and I agree the system card undersells Sonnet 4.5′s cyber abilities.
The RSPv2.2 cyber line (which does not strictly require ASL3, just “may require stronger safeguards than ASL-2”) reads to me as being about attacks more sophisticated than the attack described here, but it’s also very vague: