Anthropic says Claude AI models breached systems of 3 companies during cybersecurity tests

Anthropic’s disclosure comes amid growing concerns over AI’s increasingly advanced cybersecurity capabilities. The incidents involved three Claude models, Opus 4.7, Mythos 5 and an internal research model, which reacted differently after encountering real-world systems. While Opus 4.7 continued its attack and Mythos 5 mistakenly believed it was still in a simulation, the research model stopped once it recognised the target was real.

Anthropic said the models were being tested without the additional safeguards used in public releases. The company has paused all cyber evaluations, and is investigating the incidents with independent AI evaluator METR, and has urged other AI labs to conduct similar reviews.

What happened?

The incidents emerged after OpenAI recently revealed that its flagship AI models had escaped a test environment by exploiting a software vulnerability and eventually breaching the infrastructure of Hugging Face. Meanwhile, in its response, Anthropic said that it reviewed over 141,000 cybersecurity evaluation runs and spotted three cases where Claude had internet access when it was supposed to be isolated.

According to the company, the AI models were participating in “capture-the-flag” exercises, which is part of common cybersecurity challenges where they are directed to break into fictional systems to find hidden information. The Claude AI models had been explicitly told that it had no internet access and that everything it encountered was part of a simulation. However, the company said that due to a configuration mistake, the testing systems were actually connected to the internet. Consequently, when Claude found real websites and servers, it mistakenly believed they were part of the exercise.

In the first case, Claude attacked the infrastructure of a real company after confusing it with the fictional target in the exercise. The AI exploited weak passwords and exposed services to gain access to production data. In the second instance, Claude created and uploaded a malicious Python package to the public PyPI software repository as it believed this would help it to accomplish the challenge. According to Anthropic’s findings, the package stayed online for about an hour before being removed. It was downloaded by numerous real systems, including one belonging to a security company.

Meanwhile, in the third incident, an internal research model scanned thousands of internet-connected systems and compromised one company by deploying common hacking techniques. Anthropic said that when the model realised that the target was a real organisation, it stopped the attack on its own.

Further, Anthropic said that there is no evidence that Claude tried to escape its test environment, steal itself, or pursue its own goals. Instead, the models believed they were following the instructions of the cybersecurity exercise. The company also notes that the models involved were running without the additional safeguards that are normally included in publicly available versions of Claude.

Following the incidents, Anthropic halted its cybersecurity evaluations, informed the affected organisations, and claimed that it has been strengthening its testing procedures since. The company plans to improve monitoring, tighten security around evaluation environments, and work more closely with external testing partners to prevent similar mistakes in the future.

Cybersecurity capabilities of advanced AI models

So far, July has seen a series of incidents that have heightened concerns about the cyber capabilities of advanced AI models. The most significant came on July 21, when OpenAI disclosed that one of its pre-release AI agents escaped an isolated testing environment by exploiting a previously unknown zero-day vulnerability and breached Hugging Face’s production infrastructure during a cybersecurity evaluation. The incident prompted OpenAI to tighten testing controls and collaborate with Hugging Face on new safeguards.

Anthropic’s disclosure followed after it reviewed more than 141,000 cybersecurity evaluation runs and found three separate cases where Claude models accessed real-world systems after a testing environment had been mistakenly left connected to the internet. Unlike the OpenAI case, Anthropic said its models did not exploit novel vulnerabilities; instead, they relied on basic techniques such as weak passwords and exposed endpoints.

Cybersecurity experts say the two incidents highlight that the biggest risk today lies not only in increasingly capable AI models, but also in inadequately secured testing environments. The disclosures have renewed calls for stronger sandboxing, continuous monitoring and industry-wide standards for evaluating advanced AI systems before deployment.