Anthropic Says Claude Models Breached Three Companies During Cyber Tests
Misconfigured tests gave Claude models internet access, leading them to breach three organizations and Anthropic to suspend all cyber evaluations.
News
- Apple Tightens Mac Access Rules as AI Agents Gain Reach
- Trump Puts Intelligence Chief Jay Clayton in Charge of AI Task Force
- IBM Widens AI, Quantum Research With IIT Bombay, IISc
- OpenAI, Synopsys Build AI Model That Could Slash Chip Design Time
- Pentagon Plans Four-Star Command for AI, Drone Warfare
- California Draws the Line on AI Firings, Layoffs and Workplace Surveillance
Anthropic said some of its Claude artificial intelligence models gained unauthorized access to systems belonging to three companies during cybersecurity tests that were mistakenly connected to the public internet.
The AI company disclosed the incidents on Thursday, 30 July, after reviewing 141,006 evaluation runs. It began the review after rival OpenAI said last week that one of its agents escaped a restricted test environment and compromised infrastructure operated by AI platform Hugging Face.
Anthropic said its case resulted from an operational error involving a third-party evaluation partner. The models had been told they were working without internet access, but the testing environment remained connected to the public web.
“Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints,” Anthropic said.
Anthropic did not name the affected organizations. Two had not detected the activity before the company contacted them, while Anthropic was continuing efforts to reach the third.
The incidents involved Claude Opus 4.7, Claude Mythos 5 and an internal research model that has not been released publicly. The earliest case occurred in April, according to Anthropic.
The models were completing capture-the-flag exercises, which are simulated cybersecurity challenges that require participants to identify vulnerabilities and retrieve hidden information from test networks.
In one case, Claude Opus 4.7 was assigned a fictional target whose name matched a real company. The model found the business online, extracted application and infrastructure credentials and accessed a database containing several hundred rows of production data.
Anthropic said the model treated the real systems as part of the simulated exercise because it believed it had no access to the internet.
In another test, Claude Mythos 5 created a malicious Python package and uploaded it to the public PyPI software registry. The package was available for about an hour and ran on 15 systems. It extracted credentials from a cybersecurity company’s scanner and used them to access more of the company’s infrastructure.
In a separate incident, the internal research model scanned about 9,000 targets and compromised a company’s internet-facing application. It stopped after recognizing that the system was real and unrelated to the exercise. Anthropic said the behavior was encouraging but required further testing before the company could draw conclusions about the model’s ability to recognize unsafe situations.
Anthropic described the incidents as an “operational failure” rather than models independently escaping their environment.
The company suspended all cybersecurity evaluations on July 23 after finding evidence of outside access. It identified the three incidents by July 24 and notified the affected organizations on July 27.
Irregular, the cybersecurity laboratory involved in the evaluations, said it was investigating the incidents.
The disclosure adds to concerns about whether AI developers and outside testing laboratories have adequate controls to contain models capable of conducting cyber operations. Anthropic said stronger isolation, monitoring and validation of evaluation environments would be required as model capabilities advance.
