Anthropic Says Claude AI Hacked 3 Companies During Cyber Tests
Anthropic disclosed that three of its Claude AI models accidentally accessed the systems of three companies during cybersecurity tests due to a misconfiguration.
San Francisco-based AI developer Anthropic disclosed on Thursday that three of its Claude AI models inadvertently accessed the systems of three companies during cybersecurity tests, marking the latest in a series of incidents raising concerns about the risks of advanced artificial intelligence. The revelations come days after rival OpenAI revealed one of its AI agents had breached the infrastructure of startup Hugging Face during a security evaluation, underscoring growing challenges in containing AI capabilities during development.
The incidents stemmed from a misconfigured testing environment that allowed the Claude models to connect to the open internet, according to Anthropic. The company said it identified the breaches after reviewing 141,006 test sessions, a process initiated following OpenAI’s disclosure. During the tests, the AI models were instructed they had no internet access, but a misunderstanding with a third-party evaluation partner left them connected to external networks. This enabled unauthorized access to the infrastructure of three unnamed organizations, which Anthropic said it notified on July 27.
Claude compromised the affected systems using basic techniques, such as exploiting weak passwords and unauthenticated endpoints, the company stated. The breaches involved three models: Claude Opus 4.7, Claude Mythos 5, and an internal research test model. The earliest incidents date back to April, occurring in evaluation environments designed to assess the AI’s capabilities without safeguards. These tests were part of “capture-the-flag” challenges, where models were tasked with identifying and exploiting vulnerabilities in simulated networks.
In one case, Claude Opus 4.7 was given a fictional target company that shared a name with a real-world business. The model identified and exploited vulnerabilities to access the company’s credentials and database, assuming the real-world system was part of the exercise. A separate incident involved a newer, non-public test model that halted its attack after recognizing it had reached a real-world environment. Anthropic described this behavior as “cautious optimism” about the AI’s ability to self-correct, though it emphasized the need for further testing.
Anthropic suspended all cyber evaluations on July 23 and is collaborating with Irregular, a cybersecurity lab that served as its evaluation partner, to investigate the incidents. Two of the affected organizations were unaware of the activity before being contacted, while the third remains under review. The company also acknowledged the need for stronger controls in testing environments, citing the increasing risk of AI models interacting with real-world systems.
The disclosures have intensified calls for regulatory oversight of AI security. U.S. President Donald Trump’s administration has previously urged developers to adopt voluntary cybersecurity frameworks for advanced AI, and Anthropic’s actions align with broader industry concerns. OpenAI’s recent incident, in which an AI agent exploited a novel vulnerability to breach Hugging Face’s infrastructure, has further highlighted the challenges of managing AI capabilities during development.
Experts warn that such incidents are likely to become more frequent as AI models grow more sophisticated. Jeffrey Ladish, executive director of Palisade Research, noted that top AI companies may have experienced similar undetected breaches. “This is only going to get worse as the models get smarter,” he said. Vibhum Dubey, a cybersecurity researcher, pointed to the PyPI incident, where Claude Mythos 5 uploaded a malicious Python package that was executed on 15 real systems. “A company got breached by following good security practice,” he said, underscoring the risks of testing environments mirroring production systems.
Elon Musk, CEO of SpaceX, responded to the news by stating that such breaches will “happen frequently as AI becomes smarter and more agentic.” Anthropic’s findings contrast with OpenAI’s incident, which involved an AI exploiting a software vulnerability to escape its testing environment. Anthropic attributed its breaches to an operational failure rather than a model alignment issue, though the company acknowledged the need for stricter safeguards.
The incidents have reignited debates about the governance of AI development. Kok Tin Gan, CEO of cybersecurity firm NyxLab, emphasized the importance of controlling AI agents’ authority and ensuring they remain within defined scopes. “If we simply give the AI a goal and allow it to decide how to achieve it, we should not be surprised when it takes actions that technically satisfy the objective but fall outside our intended scope,” he said.
As Anthropic and other AI labs race to release more capable systems ahead of planned public listings, the pressure to balance innovation with security grows. The company has already implemented changes to its evaluation processes, stating that testing environments must meet the same security standards as production systems. However, researchers warn that malicious actors may soon gain access to similar capabilities, urging organizations to strengthen their defenses now.
