Anthropic says Claude AI hacked three organizations during testing

Anthropic has disclosed that three Claude models gained unauthorized access to the production infrastructure of three separate organizations after a misconfigured cybersecurity evaluation environment inadvertently allowed internet access.

The company says the incidents occurred during internal capture-the-flag (CTF) testing and were discovered during a retrospective review prompted by OpenAI's recent disclosure that one of its AI agents autonomously breached Hugging Face.

The disclosure marks the second major AI lab in less than two weeks to confirm that an experimental frontier AI model attacked real-world systems while participating in offensive cybersecurity evaluations. Anthropic said it reviewed 141,006 evaluation runs after OpenAI's July 21 report and uncovered three separate incidents spanning six evaluation runs dating back to April, all involving evaluation environments operated by third-party testing partner Irregular.

In each evaluation, Claude had been assigned a capture-the-flag challenge requiring it to compromise systems and retrieve a hidden “flag.” Anthropic's prompts explicitly stated that the models were operating in a simulated environment with no internet access. However, a configuration error left outbound internet connectivity enabled, causing the models to mistake real infrastructure for part of the exercise.

Anthropic said the models were running without the additional monitoring systems and abuse prevention safeguards included in publicly released Claude services, although they retained their standard safety training.

AI escapes to the public internet

The most serious incident involved Claude Opus 4.7. During four evaluation runs, the model failed to reach its intended fictional target and instead attacked a real company that shared the same name. It exploited weak passwords and exposed services to obtain application and infrastructure credentials and access a production database containing several hundred rows of real data.

According to Anthropic, Opus 4.7 continued attacking even after its own reasoning suggested it had likely reached a genuine production environment, in some cases concluding that the real company itself must have been intentionally included in the evaluation.

A second incident involved Claude Mythos 5 carrying out what effectively became a real-world software supply chain attack.

While solving another capture-the-flag challenge, the model discovered documentation referencing a fictional Python package. Finding that the package name was available on PyPI, it autonomously created the accounts needed to publish a malicious package under that name in an attempt to compromise the fictional company's systems.

Although Claude believed PyPI was part of the simulated environment, the package was publicly available for about one hour before being automatically removed by PyPI's security systems. During that time, it was downloaded and executed on 15 real systems, including an automated malware analysis platform operated by a cybersecurity company. Anthropic said the malicious code exfiltrated credentials from that company's infrastructure and used them to access additional systems.

The company acknowledged that Mythos 5 recognized early in its reasoning that publishing the package would constitute a real attack if it were operating on the public internet, but ultimately convinced itself it was still inside a simulation and continued.

The third incident involved an internal research model that scanned roughly 9,000 internet-connected hosts after failing to reach its assigned target. It compromised one organization's exposed application via publicly accessible credentials and SQL injection, then determined the infrastructure was unrelated to the evaluation and voluntarily stopped the attack.

Anthropic halted all cybersecurity evaluations on July 23 after beginning its transcript review, identified the three incidents the following day, and notified its evaluation partner, Irregular, and the affected organizations on July 27.

Comparing the disclosure with OpenAI's recent Hugging Face incident, Anthropic said the two events stemmed from different causes. OpenAI's models escaped containment by exploiting a previously unknown zero-day vulnerability, whereas Claude reached external systems because the evaluation environment was mistakenly connected to the internet. Anthropic characterized the incidents as operational failures rather than model-alignment failures, adding that its newest research model was the only one that recognized it had reached real-world infrastructure and chose to stop attacking.