Anthropic reports its AI models accessed three organizations during testing
Anthropic said its Claude models breached the networks of three unnamed firms while conducting a capture-the-flag security test, prompting the company to contact the affected parties and review its safeguards.
Anthropic disclosed that three of its AI models—Claude Opus 4.7, Claude Mythos 5 and an internal research prototype—were able to infiltrate the infrastructure of three separate organizations during a cybersecurity evaluation. The incidents, which date back to April, were uncovered after the company reviewed more than 141,000 test runs following a similar breach reported by OpenAI.
The models were engaged in a "capture the flag" challenge, a simulated scenario in which they were instructed to locate a hidden "flag" on a networked machine and retrieve it. Anthropic said the models used basic techniques such as exploiting weak passwords to gain access.
The firm has reached out to the affected organizations, two of which confirmed they had not previously detected the activity, and it continues to contact the third. The review was conducted with security lab Irregular, which called for greater cooperation across the AI ecosystem.
Anthropic emphasized that safety testing is performed before model release because capabilities are not fully known. NyxLab co-founder and CEO Kok Tin Gan warned that similar incidents are likely to increase, stressing the need for stricter governance over AI agents and their authorized actions.