Apparently, OpenAI isn’t the only company whose AI models have hacked into other organizations’ systems on their own. Anthropic has published a report, admitting that its AI models have also broken free from their testing environment and infiltrated three different organizations, which apparently weren’t aware of the breach until they were notified.
After OpenAI revealed the incident, wherein an AI agent it was testing exploited vulnerabilities to connect to the internet and hack into Hugging Face, Anthropic began a large-scale review of its own tests. The company specifically looked for evidence that its Claude models had accessed the internet when they shouldn’t have been able to. Turns out the models were able to access the internet in three instances and then “gained unauthorized access to the production infrastructure of three different organizations.”
Three different Claude models were involved in the incidents: Opus 4.7, the cybersecurity-focused Mythos 5 and a prototype that’s not planned for general release. They were all doing a capture-the-flag challenge when they broke free. The models were tasked with finding the “flag,” which is a piece of secret information, hidden in a different machine in Anthropic’s internal network. They were supposed to break into the machine to retrieve the flag.
Unlike in OpenAI’s case, however, the models didn’t exploit a vulnerability to get access to the internet. They seemed to have escaped the confines of their testing environment due to human error. Anthropic specified to the models in a prompt that they had no internet access, but that wasn’t the case at all. They did have internet access “due to a misunderstanding” between the company and its evaluation partner. So, when the models found access to open internet and encountered the systems of the three organizations, they treated it as part of the exercise and broke in. They didn’t deliberately attempt to escape their testing environment, Anthropic clarified.
The models used basic techniques to infiltrate the organizations, such as taking advantage of weak passwords, and din’t exploit complex vulnerabilities. Anthropic said its latest model stopped after it recognized that it was on the internet, but its older model continued attacking the affected organization anyway.
Anthropic admitted that the company and its evaluation partner could have prevented the incidents by carefully validating all internet access paths before they started their tests. They could have also reviewed their tests more frequently and thoroughly. In addition, the models could have behaved differently if they were told from the start that they did have internet access.
The company notified its evaluation partner and the three affected organizations on July 27, four days after it started reviewing its test transcripts. Two of the affected organizations weren’t aware that they had been breached. Anthropic is still trying to reach the third.
