Anthropic revealed on Thursday that its Claude AI models gained unauthorised access to the real systems of three organisations in separate incidents. The findings emerged from a wide-ranging internal review of the company’s cybersecurity evaluations, launched after OpenAI disclosed a comparable security lapse last week.
The Dario Amodei-led frontier AI lab said the review uncovered cases where Claude went beyond simulated environments and interacted with live systems. Anthropic framed the discoveries as part of its ongoing effort to identify and address security vulnerabilities in advanced AI systems. The disclosure comes as concerns grow over the risks of increasingly autonomous AI models and their potential to breach digital safeguards.
Anthropic did not name the 3 organisations involved and called on other AI companies to carry out comparable internal assessments so they can more clearly grasp the potential risks posed by their models’ abilities.
How did Anthropic discover the breach?
In a blog post, Anthropic said the incidents occurred during capture-the-flag (CTF) exercises, which test AI cybersecurity capabilities by asking models to retrieve hidden information from a fictional computer network.
Claude was told it was operating in a simulated environment with no internet access. However, a configuration error left the evaluation environment connected to the internet. As a result, the models mistook real systems for part of the exercise.
“Our models were told they had no internet access… while in fact being misconfigured to have internet access,” Anthropic said. The company added that the earliest incidents dated back to April.
The incidents involved Claude Opus 4.7, Mythos 5 and an internal research test model.
In the most serious case, Claude Opus 4.7 accessed a real company’s systems after confusing it with a fictional target that shared the same domain name. According to Anthropic, the models used basic techniques such as weak passwords, exposed credentials, unauthenticated endpoints and SQL injection rather than exploiting previously unknown vulnerabilities.
In another incident, Claude Mythos 5 uploaded a malicious Python package to the public PyPI repository. The package remained online for about an hour before being removed by PyPI’s security systems and was downloaded by 15 real systems, including an automated cybersecurity scanner.
Anthropic said its latest research model stopped once it recognised it had reached a real production environment.
‘No evidence for any of these models pursuing a goal of its own’
Anthropic clearly stated that it did not find any evidence of a model “pursuing a goal of its own”. Instead, “the models did what their evaluation asked—though in most cases, they did so while holding a false belief about whether the environment was real. ”
According to the company, the models were trying to complete assigned cybersecurity tasks while mistakenly believing they were still inside a simulation.
Unlike OpenAI’s reported incident, where models exploited a previously unknown vulnerability, Anthropic said Claude reached the internet through a misconfigured evaluation environment.
Security measures being strengthened
Anthropic noted that the first of these incidents occurred as early as April and stated that it is treating the remedial measures as if the company alone bears full responsibility. The company further added that it had halted cybersecurity evaluations on July 23, identified the incidents the following day and informed the affected organisations and evaluation partner Irregular on July 27.
The company plans to strengthen monitoring of evaluation environments, tighten oversight of third-party testing infrastructure and improve security reviews. It has also invited independent AI evaluation organisation METR to review the incidents.