Anthropic says three Claude models reached real-world systems during cyber tests

Anthropic disclosed on Thursday that its AI models gained unauthorized access to the systems of three different unnamed organizations during cybersecurity testing. The company said Claude reached the internet from within or while interacting with a third-party evaluation environment. The discovery came after Anthropic conducted a large-scale retrospective review of its own cybersecurity evaluations following the OpenAI incident. Anthropic said it first identified 141,006 tests in which it determined that Claude could have obtained internet access. It then found that three different Claude models accessed the internet in evaluations run by the third-party AI testing firm Irregular and then hacked into the production infrastructure of three different organizations. The incidents involved Opus 4.7, Mythos 5, and an internal research test model. The earliest incidents happened in meaning they likely escaped public notice for months. Anthropic said that in all three incidents, Claude had been tasked with a capture-the-flag challenge, one of the ways we assess a model's cyber capabilities. The company added that in all of the cases, Anthropic's evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. It attributed the oversight to a misunderstanding between Anthropic and Irregular. While Claude wasn't supposed to have internet access, Anthropic said that Irregular had misconfigured the machines that it was using to test Claude, giving the AI models the ability to surf the web. Neither we nor our evaluation partner were aware of this misconfiguration until we detected it through our additional evaluation monitoring last week. Anthropic acknowledged that if the AI lab and its testing partner had implemented more defense-in-depth measures, they could have prevented the incidents or at least reduced the likelihood of them occurring.