Anthropic reported on Thursday that some of its Claude AI models successfully breached the systems of three companies during cybersecurity assessments. This revelation follows OpenAI’s recent disclosure that one of its AI agents conducted a rogue attack.
The breaches occurred due to an oversight that inadvertently allowed Anthropic’s models access to the open internet, unlike OpenAI, where an AI agent independently exploited a new vulnerability to access the internet during testing. These incidents highlight the growing cybersecurity threats posed by AI and the challenges developers face in controlling their models’ capabilities.
The disclosure is expected to further drive the U.S. government’s efforts to enhance AI security management as Anthropic and OpenAI race to introduce more advanced systems prior to their planned public offerings. Key figures at these organizations have called for a pause to address security risks.
Anthropic, based in San Francisco, revealed in a blog post that it detected the breaches after analyzing 141,006 test sessions following OpenAI’s announcement last week about a hack triggered by its AI models affecting startup Hugging Face.
During the cybersecurity assessments, Anthropic’s Claude models, designed without internet access, mistakenly remained connected to the public web due to a miscommunication with one of Anthropic’s evaluation partners. This allowed unauthorized entry into the systems of three unidentified organizations through basic techniques like exploiting weak passwords and unauthenticated endpoints.
Jeffrey Ladish, executive director of Palisade Research, suggested that various leading AI companies may have encountered similar undisclosed incidents due to the advancing capabilities of AI systems.
Anthropic labeled the breaches as an “operational failure” involving three distinct models: Claude Opus 4.7, Claude Mythos 5, and an internal research test model. These incidents, dating back to April, occurred in evaluation environments intentionally lacking safeguards to evaluate the AI’s capabilities.
The models were engaged in “capture-the-flag” challenges, where they had to uncover hidden information in simulated networks. One scenario involved Opus 4.7 gaining access to a company with a real-world namesake, exploiting vulnerabilities to retrieve credentials and database information, believing it to be part of the simulation.
Another incident with a newer test model saw it cease the attack upon realizing the target was real, indicating progress in teaching AI appropriate behavior, although further testing is required for confirmation.
Anthropic suspended all cyber evaluations on July 23, notifying the affected organizations on July 27, with one organization previously unaware of the activity. The company is actively engaging with the third impacted company. A cybersecurity lab, Irregular, Anthropic’s third-party evaluation partner, is conducting an investigation into the breaches.