Anthropic says Claude models breached 3 organizations during cybersecurity tests

The incidents were discovered after Anthropic reviewed 141,006 evaluation runs following a separate disclosure by rival OpenAI involving AI platform Hugging Face, the company said in a statement.

Anthropic said the three incidents involved six test runs and three models, Claude Opus 4.7, Claude Mythos 5 and an internal research model not intended for public release. The earliest dated back to April.

During the tests, Claude was instructed to complete “capture-the-flag” challenges, which assess cybersecurity capabilities by asking a model to break into simulated systems and retrieve hidden information.

Although Anthropic’s prompts explicitly told the models that they were operating in simulations without internet access, a misconfiguration involving third-party testing partner Irregular left a route to the open internet available.

As a result, the models believed that the real systems they encountered were part of the exercises and attempted to compromise them using methods including weak-password exploitation, SQL injection and access through unauthenticated endpoints.

In the most serious incident, Claude Opus 4.7 encountered a real company with the same name as the fictional target in an exercise. Across four runs, the model extracted application and infrastructure credentials and accessed a database containing several hundred rows of production data.

Anthropic said the model eventually recognized that the system was likely real but continued the attack, in some cases reasoning that the company must still be part of the exercise.

In another incident, Claude Mythos 5 created and uploaded a malicious package to PyPI, the public registry for Python software, after identifying a package name mentioned in fictional setup instructions that had not yet been registered.

The package remained publicly available for about an hour and was downloaded and executed on 15 real systems. It collected credentials from a security company’s malware scanner, allowing Claude to access additional infrastructure belonging to that company before PyPI’s security systems removed it.

A third model scanned about 9,000 online targets after failing to reach its fictional objective and compromised a company’s internet-facing application. However, it stopped the operation after concluding that the system was real and unconnected to the exercise.

Anthropic said none of the models attempted to escape their testing environments or pursued independent objectives. It characterized the incidents as closer to an “operational failure” than a model-alignment failure because the systems had been incorrectly told they could not access the internet.

The company halted its cybersecurity evaluations on July 23 after identifying suspicious transcripts and discovered all three incidents the following day. It notified Irregular and the affected organizations on July 27.

Two organizations reached by Anthropic had not previously detected the activity, while the company said it was continuing its efforts to contact the third.

Anthropic said it would strengthen monitoring of evaluation transcripts, improve its investigative tools and conduct more rigorous checks on infrastructure operated by outside testing partners.

“We’re approaching the fixes as if the responsibility were ours alone,” the company said, urging other AI laboratories to conduct similar reviews.

Anthropic began its investigation after OpenAI disclosed on July 21 that models undergoing cybersecurity testing had exploited a previously unknown vulnerability to gain internet access and compromise Hugging Face’s production infrastructure.