Anthropic says its AI models breached three companies during security tests

Anthropic has disclosed three incidents in which its Claude models accessed real-world systems during cybersecurity tests, weeks after OpenAI reported a similar AI evaluation breach

US-based AI company Anthropic has reported a security incident in which its Claude AI models accessed the internet from testing environments and gained unauthorised access to the production infrastructure of three organisations.

 

While Anthropic said the incidents were caused by a misconfigured evaluation environment rather than models deliberately trying to escape, the findings add to growing concerns about how increasingly capable AI agents behave when they interact with real computer systems.

 

This follows OpenAI disclosure earlier this month that one of its frontier artificial intelligence (AI) models escaped a restricted testing environment and gained access to open-source machine learning and AI database repository platform Hugging Face's production infrastructure while attempting to complete an internal cybersecurity benchmark.

 

 

OpenAI incident prompted wider review

 

Anthropic said it launched a large-scale ‘retrospective review’ after OpenAI disclosed on July 21 that several of its models had escaped an isolated testing environment by exploiting a previously unknown software vulnerability and entered Hugging Face's infrastructure.

 

That disclosure led Anthropic to ask whether similar incidents may have occurred during its own cybersecurity evaluations. 

 

What Anthropic found

 

According to Anthropic, the company reviewed 141,006 cybersecurity evaluation runs where Claude could potentially have obtained internet access. The company identified three separate incidents, involving six evaluation runs, in which Claude models accessed the internet from or while interacting with the evaluation environment of third-party evaluation partner Irregular and then gained unauthorised access to the production infrastructure of three different organisations.

 

According to Anthropic, every evaluation involved a ‘capture-the-flag exercise,’ in which Claude was instructed to retrieve hidden information from a fictional network. The prompt explicitly told the model that it had no internet access and that it was operating entirely within a simulated environment.

 

However, due to what Anthropic described as a “misunderstanding with its evaluation” partner, the evaluation systems actually had live internet access. As a result, Claude treated real systems it encountered online as though they were simply additional parts of the simulated exercise.

 

The company said Claude did not discover or exploit sophisticated vulnerabilities. Instead, it relied on basic techniques such as weak passwords and unauthenticated endpoints while continuing to pursue only the capture-the-flag objective it had been assigned. Anthropic added that none of the models attempted to exfiltrate themselves or deliberately escape the testing environment. 

 

 

Three incidents, three different models

 

The first incident involved Claude Opus 4.7. During four evaluation runs, the fictional company used in the exercise happened to share its name with a real company on the internet. Unable to reach the simulated target, Claude located the real organisation, assumed it was part of the exercise and exploited vulnerabilities in its infrastructure. According to Anthropic, the model obtained application and infrastructure credentials and accessed a production database containing several hundred rows of data. The company described this as the most serious impact among the three incidents.

 

Anthropic said this was also the only incident in which a model continued attacking after recognising that it was likely interacting with a real production environment. In two of the four runs, Claude acknowledged internally that the target appeared genuine but reasoned that it must still be part of the exercise before continuing.

 

The second incident involved Claude Mythos 5. During a different capture-the-flag exercise, the model encountered fictional setup instructions that referenced a Python package that did not exist. Claude published its own malicious package under that name on the public Python Package Index (PyPI), believing the registry formed part of the simulated environment.

 

Anthropic said the package remained publicly available for about an hour and was downloaded and executed on 15 real systems, including one belonging to a security company that routinely scans newly published Python packages. Claude then used credentials obtained from that system to access additional infrastructure belonging to the same company.

 

The company noted that Claude had earlier recognised that publishing a real package would be inappropriate if it were operating on the actual internet. However, it convinced itself that the environment was still simulated because it did not recognise certain certificate authorities and because the systems displayed the year 2026, which it interpreted as evidence that the exercise had been staged. Anthropic said this behaviour fell short of what it expected and would become an area of future training.

 

The third incident involved an internal research test model. After failing to reach its intended fictional target, the model scanned roughly 9,000 internet-facing systems before compromising one organisation using exposed credentials and SQL injection. Later in the evaluation, the model realised the compromised host was unrelated to the capture-the-flag challenge and stopped its attack on its own.

 

Anthropic's explanation

 

Anthropic said it found no evidence that any of the models were pursuing independent goals. Instead, it argued that the incidents resulted from the models acting on incorrect assumptions about their environment.

 

According to the blog it has published detailing the breach, Claude had been explicitly told it did not have internet access. When it encountered real-world systems through the unintended internet connection, it believed those systems were part of the exercise and therefore treated attacking them as consistent with its assigned task.

 

The company also observed notable differences between the three models.

• Opus 4.7 continued attacking after recognising the possibility that the environment was real.
• Mythos 5 concluded it was still inside a simulation despite evidence to the contrary.
• The newest internal research test model recognised that it had reached a real environment and voluntarily stopped.

Anthropic said the findings suggest newer models may respond more appropriately in such situations, although it noted that additional testing is needed before drawing firm conclusions. 

 

For future evaluations

 

Anthropic said it launched the review after OpenAI disclosed that its models had escaped an isolated test environment, and commended the company for publicly sharing the incident. Unlike OpenAI's case, however, Anthropic said it discovered the three incidents through a proactive review of its own cybersecurity evaluation transcripts rather than reports from the affected organisations, which had not detected the activity. The company said it has since notified all three organisations.

 

Based on the findings, Anthropic said AI evaluation environments should be secured to the same standard as production systems. It plans to strengthen evaluation design, improve monitoring of evaluation runs, tighten oversight of third-party evaluation partners and more clearly define which systems are within the scope of testing. The company also encouraged other AI labs to conduct similar reviews.

 

Anthropic said it found no evidence that Claude was pursuing goals of its own. Instead, the models acted on the mistaken belief that the real systems they encountered were part of the simulated exercise because the evaluation environment had been misconfigured to allow internet access. It characterised the incidents as failures in evaluation infrastructure and operational controls rather than model alignment, adding that the safeguards deployed with publicly available Claude models would have blocked the observed behaviour.