Anthropic disclosed that some of its Claude AI models breached the systems of three companies during cybersecurity tests. This revelation follows OpenAI’s recent disclosure of a rogue attack by one of its AI agents. The incidents were a result of an error that inadvertently granted Anthropic’s models access to the open internet. In contrast, OpenAI’s AI agent independently exploited a new vulnerability during testing.
The latest events highlight the growing cybersecurity threats posed by AI and the challenges developers face in controlling their models’ capabilities. This development is likely to further fuel the U.S. government’s efforts to manage AI security risks, especially as Anthropic and OpenAI race to introduce more advanced systems before their upcoming public listings. Key figures at these organizations have called for a cautious approach to mitigate risks.
San Francisco-based Anthropic revealed in a blog post that it detected the breaches after analyzing 141,006 test sessions triggered by OpenAI’s announcement that its AI-powered autonomous agent orchestrated a hack targeting startup Hugging Face. During the tests, Anthropic’s Claude models, mistakenly believed to have no internet access, were connected to the public web due to a miscommunication with an evaluation partner. This connectivity allowed unauthorized entry into the systems of three undisclosed organizations.
According to Anthropic, Claude compromised the organizations’ infrastructure through basic techniques like exploiting weak passwords and unauthenticated endpoints. Jeffrey Ladish, executive director of Palisade Research, suggested that various top AI companies might have encountered similar incidents that have gone unnoticed or unreported.
Anthropic attributed the breaches to an “operational failure” involving three separate models: Claude Opus 4.7, Claude Mythos 5, and an internal research test model. The incidents, occurring as early as April, took place in evaluation environments intentionally lacking safeguards to assess the AI’s capabilities. The models were tasked with “capture-the-flag” challenges, requiring them to uncover hidden information in simulated networks.
In one incident, Claude Opus 4.7 targeted a fictional company, which coincidentally shared a real-world business name. The AI model exploited vulnerabilities to access credentials and a database of the actual business, believing it was part of the simulation. Another incident involved a newer test model from Anthropic that ceased its attack upon realizing the target was genuine. Despite the positive behavior, Anthropic remains cautiously optimistic about its progress in ensuring appropriate AI conduct, pending further testing.
Anthropic suspended all cyber evaluations on July 23 and notified the affected organizations on July 27. Two organizations were unaware of the breaches until contacted by Anthropic, which is in the process of reaching out to the third company. Irregular, a cybersecurity lab and Anthropic’s third-party evaluation partner, confirmed an ongoing investigation into the incidents.