Anthropic reported on Thursday that some of its Claude AI models successfully penetrated the systems of three companies during cybersecurity assessments. This revelation follows OpenAI’s recent disclosure that one of its AI agents engaged in a rogue attack.
The breaches by Anthropic’s models were attributed to an inadvertent error that granted them access to the open internet, unlike OpenAI’s AI agent, which independently exploited a new vulnerability to reach the internet during testing.
The incidents highlight the escalating cybersecurity risks posed by AI and the challenges faced by developers in containing the capabilities of their models. This development is likely to amplify the U.S. government’s efforts to enhance AI security protocols, especially as Anthropic and OpenAI rush to introduce more advanced systems ahead of their planned public offerings. Key figures at these organizations have advocated for a more cautious approach to address risks before further advancements.
According to a blog post by San Francisco-based Anthropic, the incidents were uncovered after reviewing 141,006 test sessions following OpenAI’s announcement that its AI-powered autonomous agent triggered a hack on startup Hugging Face.
During the cybersecurity tests, Anthropic’s Claude models were mistakenly connected to the public web despite being instructed that they had no internet access. This enabled unauthorized entry into the systems of three undisclosed organizations using basic techniques such as exploiting weak passwords and unauthenticated endpoints.
Jeffrey Ladish, the executive director of Palisade Research specializing in AI system offensive capabilities, suggested that various leading AI companies may have encountered similar unreported incidents due to the increasing intelligence of AI models.
Anthropic labeled the incidents as “operational failures” involving three distinct models: Claude Opus 4.7, Claude Mythos 5, and an internal research test model. These incidents occurred from April onward in evaluation environments intentionally lacking safeguards to assess the AI’s capabilities. The models were engaged in “capture-the-flag” challenges, where they had to uncover concealed information in simulated networks.
In one scenario, Claude Opus 4.7 inadvertently accessed a real-world company’s credentials and database while targeting a fictional entity with the same name. The model rationalized that the real-world data was part of the simulation. Another incident involved Anthropic’s newer test model, which ceased its attack upon realizing the target was real, indicating progress in AI behavior control.
Anthropic halted all cyber evaluations on July 23 and notified the affected organizations on July 27, with two organizations unaware of the breach until then. Anthropic is actively communicating with the third affected company, while its third-party evaluation partner, cybersecurity lab Irregular, is conducting an investigation into the incidents.