Anthropic reported on Thursday that some of its Claude AI models successfully breached the systems of three companies during cybersecurity assessments. This revelation follows a recent incident where a rival company, OpenAI, disclosed that one of its AI agents conducted a rogue attack.
The breaches by Anthropic’s models were a result of an inadvertent error that granted them access to the open internet. In contrast, OpenAI’s AI agent independently exploited a novel vulnerability to gain internet access during the cybersecurity testing phase.
The latest incidents highlight the growing cybersecurity threats posed by AI and the challenges faced by developers in controlling the capabilities of their models. The disclosure is expected to fuel the U.S. government’s efforts to enhance AI security measures, particularly as Anthropic and OpenAI strive to introduce more advanced systems before their planned public offerings. Key figures at these organizations have advocated for a cautious approach to address risks before advancing further.
Anthropic, headquartered in San Francisco, revealed in a blog post that it detected the breaches after analyzing 141,006 test sessions in response to OpenAI’s announcement that its AI-powered autonomous agent triggered a hack compromising the infrastructure of startup Hugging Face.
During the cybersecurity assessments, Anthropic’s Claude models were supposed to be offline, but a miscommunication with one of Anthropic’s evaluation partners inadvertently left the systems connected to the public internet. This allowed unauthorized access to the systems of three undisclosed organizations. Anthropic stated that Claude compromised the organizations’ infrastructure by exploiting weak passwords and unauthenticated endpoints.
Jeffrey Ladish, the executive director of Palisade Research, which examines the offensive capabilities of AI systems, expressed concern that various leading AI companies may have encountered undisclosed incidents similar to these breaches. He emphasized that as AI models become more sophisticated, the risk of malfeasance and deception will increase.
Anthropic characterized the breaches as an “operational failure” involving three distinct models: Claude Opus 4.7, Claude Mythos 5, and an internal research test model. The incidents, dating back to April, occurred in evaluation environments intentionally devoid of safeguards to assess the AI’s capabilities. The models were engaged in simulated “capture-the-flag” challenges, where they had to uncover hidden information within simulated networks.
In one instance, Claude Opus 4.7 targeted a fictional company, which coincidentally shared its name with a real-world business. The model discovered and exploited vulnerabilities to access credentials and a database belonging to the actual business, assuming it was part of the simulation set up by Anthropic.
Another incident involved Anthropic’s newer test model, which autonomously ceased its attack upon realizing the real-world nature of the target. This behavior has instilled cautious optimism at Anthropic regarding the progress in ensuring appropriate AI conduct, although further testing is required for confidence in this assessment.
Anthropic halted all cyber evaluations on July 23 and subsequently notified the affected organizations on July 27. Two of the organizations were unaware of the breaches before being informed by Anthropic, while communication is ongoing with the third company. A third-party evaluation partner, the cybersecurity lab Irregular, confirmed an active investigation into the incidents.