Anthropic has revealed that an internal investigation uncovered three separate incidents in which its Claude AI model gained unauthorized access to the live systems of three organizations during cybersecurity testing.
The disclosure comes just over a week after OpenAI reported that one of its unreleased AI models breached Hugging Face’s infrastructure while undergoing internal evaluations.
According to Anthropic, the company launched its own review following OpenAI’s July 21 disclosure to determine whether Claude had ever reached the public internet from testing environments that were supposed to remain isolated. After examining 141,006 evaluation runs, the company identified three cases in which Claude accessed the internet while interacting with cybersecurity partner Irregular.
The investigation found that the incidents were caused by a configuration mistake in the evaluation environment. Anthropic said both companies misunderstood whether the testing setup had internet connectivity, when in reality it did. While Irregular is conducting its own investigation, Anthropic said it is treating the issue as its own responsibility rather than placing blame on its partner.
Because of the unintended internet connection, three different Claude models—Opus 4.7, Mythos 5, and an internal research model—were able to access the production infrastructure of three separate organizations without authorization.
Anthropic said each model had been explicitly instructed that it had no internet access. However, once the models encountered real-world systems, they interpreted them as part of the cybersecurity exercise and continued carrying out their assigned tasks.
The company found that the models responded differently after discovering they had reached real infrastructure. Opus 4.7 recognized in every test that it was interacting with a live production system, yet still continued its attack. In some cases, it justified its actions by assuming the real company was intentionally included in the exercise. During those tests, the model accessed credentials and interacted with a production database.
Mythos 5 also detected signs that it had reached the real internet but convinced itself it was still operating inside a simulation. It proceeded to publish a malicious software package to the public Python Package Index (PyPI). Anthropic said the package was downloaded and executed by external systems before the activity was detected and stopped.
Only Anthropic’s newest internal research model halted its actions after determining that the target was a real production environment instead of a simulated one.
Anthropic noted that these evaluations intentionally disabled the additional safety systems and monitoring tools normally used with publicly available Claude models. The company said those safeguards would likely have prevented the unauthorized behavior, but they were removed so researchers could measure the models’ raw capabilities.
The company emphasized that it found no evidence suggesting the AI models developed independent goals or acted autonomously. Instead, the models simply attempted to complete the cybersecurity tasks they had been assigned.
Anthropic also highlighted a key difference between its findings and OpenAI’s recent incident. While OpenAI reported that its model exploited an unknown software vulnerability to escape its testing environment, Anthropic said Claude reached the internet only because a network connection had accidentally been left open.
OpenAI has since shared additional details about its own investigation, stating that its model also used publicly exposed credentials across four different online accounts, including one used as a staging point and another for storage, while two additional accounts were accessed but not used for further compromise.
Anthropic said it identified the incidents through its own proactive review rather than being alerted by the affected organizations, which had not detected the unauthorized activity themselves. The company is now working with independent AI evaluation group METR to conduct an external review of the incidents.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The disclosure adds another significant example to the growing debate over AI safety and cybersecurity. Following OpenAI’s accidental breach of Hugging Face—the first confirmed case of an AI laboratory temporarily losing control of a model during testing—Anthropic’s findings are expected to intensify discussions among researchers, security experts, and policymakers about how advanced AI systems should be evaluated and contained.
