Anthropic says Claude breached three companies during cybersecurity tests

Anthropic said an internal investigation found three incidents in which Claude breached the systems of three organizations during cybersecurity tests. The review followed OpenAI’s disclosure that one of its unreleased models breached Hugging Face’s systems during internal testing.

According to Anthropic, the Claude models reached the internet from within a testing environment while interacting with a third party, then gained unauthorized access to live systems. The company said the testing environments were intended to function as sandboxes that keep models isolated.

Anthropic reviewed 141,006 evaluation runs and found three cases in which Claude accessed the internet while interacting with Irregular, one of its third-party partners. Anthropic said the incidents traced back to a misconfiguration in an evaluation environment run with Irregular.

The company described the issue as a misunderstanding between the two companies over whether the test setup had internet access. Anthropic said it is not placing blame and is approaching fixes as if the responsibility were its alone, while Irregular conducts its own investigation.

Anthropic said the incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model. In each case, Anthropic said Claude was explicitly told by the prompt that it had no internet access, and the company said the models appeared to treat real-world systems as part of the assigned exercise.

Opus 4.7 recognized it had reached a real production system in all four runs of its incident but continued, including pulling credentials and touching a database of production data. Mythos 5 detected signs it was on the real internet, then reasoned its way back into treating the situation as a simulation and published a malicious software package to PyPI that was downloaded and run by outside systems before being caught. Anthropic said only the internal research test model stopped on its own after concluding the target was real.

Anthropic said powerful AI models require significant controls during cybersecurity evaluations. The company noted that Claude was running without additional safety monitoring and classifiers used on generally available models, because the evaluations were designed to measure raw model capabilities.

Anthropic said it found no evidence of any model pursuing a goal of its own, saying the models were trying to complete the task they were given. The company also said its situation differed from OpenAI’s Hugging Face incident because Anthropic’s models reached the internet through an accidentally open path, while OpenAI’s model exploited an unknown software vulnerability to break out of its test environment.

Anthropic said it discovered the incidents through a proactive review, and that two affected organizations it was able to reach had not previously detected or flagged the activity. The company is now working with METR on a third-party review of the incidents.