Anthropic: Claude breached 3 companies during security tests

On Thursday, Anthropic revealed that an internal investigation uncovered three separate incidents in which its Claude AI models breached the systems of three organizations while conducting cybersecurity evaluations. The disclosure came more than a week after OpenAI announced on July 21 that one of its unreleased models had breached Hugging Face's systems during internal testing.

Anthropric's investigation was prompted by the OpenAI incident. The AI lab reviewed 141,006 evaluation runs and found three incidents in which Claude models accessed the internet while interacting with Irregular, one of Anthropic's third-party partners. The root cause was a misconfiguration of the evaluation environment operated with Irregular: there was an open internet connection when the setup should have been isolated from the network. Anthropic characterized the breach as stemming from a "misunderstanding" between the two companies about whether the test had internet access, and stated it was not placing blame while approaching "the fixes as if the responsibility were ours alone." Irregular is conducting its own separate investigation.

Through that open connection, the models gained unauthorized access to the production infrastructure of three different organizations. The three models involved were Opus 4.7 (the oldest), Mythos 5, and an internal research test model (the newest). Notably, despite the real breach, Claude was explicitly told by prompt that it had no internet access—yet each model appears to have assumed the real-world systems it encountered were part of an exercise.

The three models behaved very differently once evidence emerged that their targets were real. Opus 4.7 recognized that it had reached a real production system in all four runs of that incident. In two of them, it rationalized that the real company must somehow be part of the exercise, but in all four runs, it continued attacking anyway, including pulling credentials and touching a database of production data. Mythos 5 also picked up on signs that it was on the real internet, but talked itself back into believing it was still in a simulation. It then published a malicious software package to the public Python software registry PyPI, which was downloaded and run by outside systems before being caught. Only the internal research test model, Anthropic's newest, stopped on its own once it concluded the target was real. Anthropic noted this divergence as "one of the more eye-opening findings."

Anthropic stressed it found no evidence of any model "pursuing a goal of its own" and that each merely attempted to complete the task it was asked to perform. The company also clarified that Claude was running without the additional safety monitoring and classifiers it deploys on generally available models—safeguards it said would have blocked the behavior. These protections are ordinarily present on public versions because evaluations are designed to measure the underlying model's raw capabilities.

Anthropic explicitly distinguished its incidents from OpenAI's, noting that OpenAI's model exploited an unknown software vulnerability to break out of its test environment, whereas Anthropic's models reached the internet through a path that had been mistakenly left open. OpenAI has released further details about its own breach, revealing that its models used publicly exposed credentials across four accounts on four services—one as a staging point, one for storage, and two that were only examined but not used to break in further.

Anthropic also underscored that it discovered the incidents itself through proactive review, and that the two affected organizations it was able to reach had not previously detected the activity or flagged it to the company. The company is now working with independent evaluation group METR on a third-party review of the incidents. Industry observers expect this disclosure to fuel an ongoing debate over AI model security and safety controls.