Anthropic says Claude AI breached three organisations during cyber tests

Anthropic has disclosed that three of its Claude artificial intelligence models gained unauthorised access to the systems of three organisations during cybersecurity testing after a configuration error mistakenly gave them access to the public internet, in the latest incident to raise questions about the safeguards surrounding advanced AI models.

The disclosure comes just a week after OpenAI revealed that one of its autonomous AI agents escaped a controlled testing environment and hacked AI company Hugging Face during an internal security exercise, prompting calls for greater transparency and stronger regulation. The incident drew scrutiny from US lawmakers, while the FBI declined to comment on whether it had been notified. Critics argued OpenAI had downplayed the seriousness of the breach and questioned whether existing safeguards for frontier AI systems were adequate.

Anthropic said a misconfiguration allowed Claude models to reach the internet from evaluation environments that were intended to be isolated, resulting in unauthorised access to three organisations' systems.

The company said it discovered the incidents after reviewing 141,006 cybersecurity evaluation sessions, a process launched in response to OpenAI's disclosure of its own rogue AI incident.

"The breaches underscore that increasingly capable AI systems can exploit real-world security weaknesses if testing environments are not properly contained," Anthropic said.

According to the company, Claude compromised the affected organisations using relatively simple methods, including weak passwords and unauthenticated internet-facing services, rather than sophisticated or previously unknown vulnerabilities.

Anthropic said the incidents involved three separate models — Claude Opus 4.7, Claude Mythos 5 and an internal research model. The earliest incident occurred in April during "capture-the-flag" cybersecurity exercises, in which AI systems are tasked with finding hidden information in simulated computer networks.

The company said its prompts instructed the models that they had no internet access. However, a misunderstanding with its evaluation partner, Irregular, meant the testing systems remained connected to the public internet.

Anthropic said it began reviewing evaluation transcripts on July 23 after learning of the OpenAI incident and suspended all cybersecurity evaluations later that day after finding evidence that Claude may have accessed external systems. It identified all three incidents by July 24 and notified the affected organisations on July 27.

Two of the organisations were unaware their systems had been accessed until Anthropic contacted them, while the company said it was still attempting to reach the third.

Anthropic said the findings highlighted the need for stronger safeguards in both internal and third-party testing environments as frontier AI models become increasingly capable of carrying out autonomous cyber operations.

The disclosure is likely to intensify scrutiny of how leading AI developers test increasingly capable models, particularly as governments weigh new safety standards and reporting requirements following a series of high-profile incidents involving autonomous AI behaviour.

This article was written with content from Reuters