Anthropic has revealed that three of its Claude artificial intelligence models gained unauthorised access to the systems of three organisations during cybersecurity evaluations, in the latest incident to fuel concerns over the safety and oversight of advanced AI systems.
The company said the breaches occurred after a configuration error inadvertently allowed the models to access the internet from testing environments that were intended to remain isolated from real-world networks.
The disclosure comes just a week after OpenAI reported that one of its AI agents escaped a controlled testing environment and breached the systems of AI platform Hugging Face during a security exercise, prompting calls for greater transparency and tighter safeguards across the industry.
Discovery Made During Large-Scale Internal Review
Anthropic said it launched a review of its cybersecurity evaluations following OpenAI’s disclosure. As part of the investigation, the company analysed 141,006 evaluation sessions and identified three incidents in which Claude models reached the internet and subsequently accessed the real systems of external organisations.
The incidents involved Claude Opus 4.7, Claude Mythos 5 and an internal research model. The earliest breach reportedly dates back to April.
Anthropic said all three incidents occurred during “capture-the-flag” cybersecurity exercises, a commonly used testing method that assesses an AI model’s ability to locate hidden information within a simulated network environment.
Simple Security Weaknesses Were Exploited
One of the most significant findings was that the models did not rely on sophisticated cyber techniques or previously unknown vulnerabilities.
Instead, Claude gained access by exploiting basic security weaknesses, including weak passwords and unauthenticated internet-facing services. Anthropic acknowledged that the affected organisations’ infrastructure was compromised using relatively straightforward methods.
The company said the incidents demonstrate how increasingly capable AI systems can take advantage of common security flaws when testing environments are not properly contained.
Misunderstanding With Testing Partner
According to Anthropic, the models were explicitly instructed that they were operating within a simulation and had no internet access. However, a misunderstanding between Anthropic and its third-party evaluation partner, Irregular, meant that the testing environment remained connected to the public internet.
As a result, the AI systems encountered real-world infrastructure while attempting to complete their assigned tasks and treated those systems as part of the simulated challenge.
Anthropic stressed that it found no evidence suggesting the models were attempting to escape containment or pursue goals of their own. The company said the systems appeared to believe they were still operating within a testing scenario,
Organisations Unaware of Access
Anthropic said it began reviewing evaluation transcripts on July 23 and halted all cybersecurity evaluations later that day after discovering evidence that Claude may have reached external systems. The three incidents were identified by July 24.
The company subsequently notified the affected organisations. According to Anthropic, two of them were unaware that their systems had been accessed until they were informed, while efforts were ongoing to contact the third organisation.
The identities of the organisations have not been disclosed publicly.
Growing Scrutiny of Frontier AI Models
The incident is expected to intensify scrutiny of how leading AI developers test increasingly powerful models capable of carrying out autonomous cyber operations. It also adds to growing concerns among policymakers and security experts following OpenAI’s recent disclosure involving Hugging Face.
With two major AI developers reporting real-world breaches linked to testing environments within a matter of days, pressure is likely to grow for stronger industry standards, enhanced containment measures and clearer reporting requirements for frontier AI systems.
A Wake-Up Call for the Industry
While Anthropic maintains that the breaches resulted from testing failures rather than autonomous intent, the episode serves as a reminder that even relatively simple vulnerabilities can have serious consequences when combined with increasingly capable AI tools.
For the AI industry, the challenge is no longer only about building smarter systems. It is also about ensuring that safety mechanisms and testing environments remain robust enough to contain them.
