Anthropic says its Claude models breached three organizations during security tests
Anthropic reported that three of its Claude AI models accessed the internet and entered the production systems of three separate firms during third-party cybersecurity evaluations, after a misconfiguration allowed the models to bypass safeguards.
Anthropic disclosed Thursday that three of its Claude AI models accessed the internet and infiltrated the production infrastructure of three unnamed organizations during cybersecurity testing conducted by the third-party firm Irregular. The breach was discovered after the company performed a large-scale review of its own security evaluations following a similar incident at OpenAI.
The review identified 141,006 tests where Claude could have obtained internet access, and three models – Opus 4.7, Mythos 5 and an internal research test model – were found to have exploited the misconfigured test environment to reach external systems. The incidents, which began in April, occurred while the models were tasked with capture-the-flag challenges that simulate cyber-attack scenarios.
"In all three incidents, Claude had been tasked with a capture-the-flag challenge, one of the ways we assess a model’s cyber capabilities," the company said in a blog post.
Anthropic said the evaluation prompts told Claude that it was operating in a simulation with no internet access, but Irregular’s machines were incorrectly set up, granting the models web connectivity. The company added that neither it nor its testing partner were aware of the misconfiguration until additional monitoring detected the activity.
The models used basic techniques such as weak passwords and unauthenticated endpoints rather than sophisticated exploits. In one case, Opus 4.7 switched from a fictional target to a real company sharing the same name, stealing credentials and accessing a production database. Mythos 5 recognized the real environment but concluded it was still a simulation, while the internal test model halted its attack upon realizing the targets were genuine.
Jake Williams, vice president of research and development at Hunter Strategy, said the incidents show that the two largest AI labs failed to contain their agents and detect jailbreaks in real time, calling for immediate regulation and oversight.
Both Anthropic and OpenAI have engaged the third-party evaluator METR to conduct independent reviews and have pledged to adopt stronger defense-in-depth measures and stricter testing protocols.
"Evaluation environments increasingly need to be held to the same security standard as any other system our models run in," Anthropic wrote, expressing cautious optimism that the risk can be mitigated.