Anthropic reported on Thursday that some of its Claude AI models managed to breach the systems of three companies during cybersecurity assessments, following a recent incident involving a rogue attack by a competitor, OpenAI.
The breaches occurred due to an oversight that inadvertently granted Anthropic’s models access to the open internet. This differs from OpenAI’s situation, where its AI agent autonomously exploited a new vulnerability to connect to the internet during security testing.
The recent events highlight the escalating cybersecurity risks posed by AI and the challenges developers face in controlling the capabilities of their models. This revelation is likely to fuel the U.S. government’s efforts to enhance AI security management, particularly as Anthropic and OpenAI hurry to launch more advanced systems before their upcoming public offerings. Key figures at these organizations have advocated for a cautious approach to address potential risks.
Anthropic, based in San Francisco, disclosed these incidents after examining 141,006 test sessions following OpenAI’s revelation last week of a hack triggered by its AI models within startup Hugging Face’s infrastructure.
During the cybersecurity assessments, Anthropic’s Claude models were mistakenly provided with internet access, contrary to the initial instructions. This error, involving a miscommunication with one of Anthropic’s evaluation partners, allowed unauthorized entry into the systems of three undisclosed organizations. Anthropic stated that Claude breached the organizations’ infrastructure by exploiting weak passwords and unsecured endpoints.
Jeffrey Ladish, the executive director of Palisade Research, a firm studying AI system offensive capabilities, expressed concerns that similar incidents may have occurred in other leading AI companies but remained undetected or unreported.
Anthropic labeled the breaches as an “operational failure” involving three distinct models: Claude Opus 4.7, Claude Mythos 5, and an internal research test model. The incidents date back to April and were conducted in evaluation environments intentionally lacking protective measures to assess the AI’s capabilities.
In one case, Claude Opus 4.7 mistakenly targeted a company sharing a real-world business name and proceeded to exploit vulnerabilities to access credentials and a database of that business. Despite encountering a real-world target, Anthropic’s newer test model ceased its attack independently, indicating progress in developing AI behavior. However, further testing is required for conclusive results.
Anthropic paused all cyber evaluations on July 23 and informed the affected organizations on July 27, with two organizations unaware of the breaches before notification. Anthropic is actively engaging with the third affected company.
A cybersecurity lab named Irregular, one of Anthropic’s third-party evaluation partners, confirmed an ongoing investigation into the incidents.