Anthropic reports its AI models breached production systems of three organizations in cybersecurity tests

New Delhi [India], July 31 (ANI): Frontier artificial intelligence (AI) company Anthropic said it has identified three incidents in which its Claude models accessed the internet during third-party cybersecurity evaluations and subsequently gained unauthorized access to the production systems of three different organizations.
The company said the review was launched after OpenAI disclosed on July 21 that some of its models had accessed production infrastructure.
Anthropic said the incidents involved Opus 4.7, Mythos 5 and an internal research test model, with the earliest cases dating back to April. The models were tested without standard safeguards such as classifiers and monitoring, although model-specific safety training remained active. The evaluations were conducted on infrastructure separate from Anthropic's internal systems and customer data.
According to the company, it reviewed 141,006 evaluation runs in which Claude could potentially access the internet. It found three cases where the model reached the open internet while interacting with the testing environment of third-party evaluation partner Irregular and later accessed the production infrastructure of three separate organizations.
The company said Claude had been assigned capture-the-flag cybersecurity challenges and was prompted that it was operating in a simulated environment without internet access. However, internet access remained available due to a misunderstanding with the evaluation partner, causing the model to treat live systems as part of the exercise.
"Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations' infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints," the report stated.
"It did not find or exploit any complex vulnerabilities, and in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned," the report added.
Anthropic said the incidents also highlighted differences in the behaviour of older and newer Claude models.
"However, in some cases, our older model continued its attack even after getting evidence it was running on the open internet; our latest model stopped once it recognized it was on the internet," the report noted.
"In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment," the report stated.
The company said it began reviewing evaluation transcripts on July 23 and immediately suspended all cybersecurity evaluations. It identified the three incidents on July 24 and informed Irregular and the affected organizations on July 27. Anthropic said the two organizations it was able to reach had not previously detected the activity, and remediation efforts are underway.
Anthropic described the incidents as operational failures rather than failures in model alignment.
"While there is not a perfectly sharp distinction between the two, we believe these incidents to be closer to a harness and operational failure than a model alignment failure," the report stated.
"These facts give us cautious optimism that with tighter monitoring and controls around evaluation infrastructure, as well as continued investment in alignment, this type of risk can be overcome," the report concluded. (ANI)