Anthropic has disclosed that its Claude artificial intelligence (AI) models gained unauthorised access to the production infrastructure of three organisations during cyber security evaluations.
This is the latest incident to raise concerns about the security risks posed by increasingly autonomous AI agents.
The AI company says it uncovered the incidents during a retrospective review of more than 141 000 cyber security evaluation runs, after ChatGPT-maker OpenAI revealed last month that several of its own models had escaped an isolated testing environment and breached the production infrastructure of open source AI platform Hugging Face.
According to Anthropic, three separate Claude models – Opus 4.7, Mythos 5 and an internal research model – accessed the internet from what they had been told were sealed evaluation environments before compromising the live systems of three organisations.
The incidents dated back to April and occurred during capture-the-flag cyber security exercises conducted with third-party evaluation partner Irregular.
Anthropic stresses that the models did not deliberately attempt to escape their testing environments, or pursue independent goals.
Instead, it notes the models believed they were operating inside simulated environments after a misconfiguration left internet access unintentionally available.
“In all cases, our evaluation prompt stated explicitly that Claude had no internet access,” Anthropic says.
“Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available.”
Basic hacking techniques
The company says the models employed relatively basic hacking techniques, including exploiting weak passwords, exposed credentials, unauthenticated endpoints and SQL injection attacks, rather than discovering sophisticated vulnerabilities.
In the most serious incident, Claude Opus 4.7 compromised a real company’s infrastructure after confusing it with the fictional target in the evaluation.
The model extracted application and infrastructure credentials and accessed a production database containing several hundred rows of live data. Anthropic describes this as the most significant impact identified during its review.
A second incident involved Claude Mythos 5 creating and publishing a malicious Python package to the public PyPI software repository after believing it was still operating inside a simulated environment.
The package remained online for about an hour and was downloaded by 15 real systems, including an automated malware scanner operated by a security company. Anthropic says the model subsequently used credentials obtained through the scanner to access additional infrastructure.
In the third incident, an internal research model scanned roughly 9 000 internet-connected systems before compromising a company’s internet-facing application using exposed credentials and SQL injection.
Unlike the older models, Anthropic says the research model halted the attack after recognising it had reached a real production environment rather than a simulation.
Anthropic began its investigation after OpenAI disclosed on 21 July that several GPT models had escaped an isolated test environment by exploiting a previously unknown zero-day vulnerability.
Those models subsequently gained access to parts of Hugging Face’s production infrastructure before the incident was detected and contained.
OpenAI later said the breach prompted a review of its evaluation infrastructure and highlighted how advanced AI models are increasingly capable of autonomously identifying software weaknesses and improving the systems that run them.
Anthropic says its incidents differ from OpenAI’s because Claude did not exploit a software vulnerability to escape containment.
Instead, the company describes the events as an operational and evaluation infrastructure failure, arguing that the models had been misled into believing real-world systems formed part of the cyber security exercise.
“We believe these incidents to be closer to a harness and operational failure than a model alignment failure,” the company says.
Growing concerns
The incidents nevertheless underscore growing concerns across the AI industry about the cyber capabilities of frontier AI models.
In recent weeks, both OpenAI and Anthropic have acknowledged that increasingly capable models are able to autonomously conduct sophisticated offensive cyber security tasks, prompting both companies to strengthen testing environments and monitoring systems.
Anthropic says it has halted the affected cyber security evaluations, notified the organisations involved and is working with its evaluation partner to improve containment, monitoring and validation procedures.
It also plans to expand continuous monitoring of evaluation transcripts, strengthen oversight of third-party testing infrastructure and conduct more rigorous security assurance work with external partners.
Share
