{"id":16537,"date":"2026-07-31T08:56:16","date_gmt":"2026-07-31T08:56:16","guid":{"rendered":"https:\/\/newestek.com\/?p=16537"},"modified":"2026-07-31T08:56:16","modified_gmt":"2026-07-31T08:56:16","slug":"after-openai-anthropic-finds-claude-breached-three-organizations-during-cyber-tests","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16537","title":{"rendered":"After OpenAI, Anthropic finds Claude breached three organizations during cyber tests"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Less than two weeks after OpenAI disclosed that an experimental AI model breached Hugging Face during a cybersecurity evaluation, Anthropic has revealed that its own review uncovered three incidents in which Claude models gained unauthorized access to the production infrastructure of three organizations during similar testing.<\/p>\n

Anthropic said it launched the review after OpenAI disclosed that one of its experimental models had escaped its evaluation environment.<\/p>\n

\u201cAfter reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations,\u201d Anthropic said in a blog post<\/a>.<\/p>\n

The company, however, did not name the three organizations. It also did not immediately respond to a request for comment.<\/p>\n

The disclosure makes Anthropic the second frontier<\/a> AI developer in recent weeks to report autonomous AI models interacting with real-world production systems during pre-release cybersecurity testing.<\/p>\n

Anthropic said its incidents stemmed from a misconfigured evaluation environment that allowed internet access, while OpenAI attributed its incident to an experimental model exploiting a previously unknown vulnerability to escape its testing environment.<\/p>\n

Misconfigured evaluation environment exposed real-world systems<\/h2>\n

Anthropic said the incidents occurred during capture-the-flag exercises designed to measure Claude\u2019s offensive cyber capabilities. The company said it believed the evaluation environment was isolated from the public internet but later discovered that internet access had been available because of a misunderstanding with its third-party evaluation partner.<\/p>\n

\u201cDue to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude\u2019s search led it to real systems on the open internet, it treated them as part of the exercise,\u201d Anthropic said.<\/p>\n

Anthropic said three different models \u2014 Claude Opus 4.7, Mythos 5, and an internal research model \u2014 were involved in incidents that occurred in April.<\/p>\n

Anthropic said the most serious incident involved Claude Opus 4.7 exploiting vulnerabilities at a real company whose domain matched the fictional evaluation target, allowing the model to obtain application credentials and access a production database.<\/p>\n

\u201cIn four runs of this evaluation, Claude ran into difficulty reaching its simulated target within the evaluation environment, but then discovered that the real company was reachable via the internet,\u201d the blog post added. \u201cAssuming this was the intended target in the capture-the-flag task, Claude sought, identified, and exploited vulnerabilities within the company\u2019s infrastructure, believing it to be part of the exercise\u2026 This represented the most serious impact we identified.\u201d<\/p>\n

In a second incident, Anthropic said Claude Mythos 5 published a malicious Python package to the public PyPI repository while attempting to compromise a simulated target. The package remained publicly available for about an hour and was downloaded and executed on 15 real systems before it was removed, according to the company.<\/p>\n

The third incident involved an internal research model scanning roughly 9,000 internet-facing hosts before exploiting exposed credentials and SQL injection to access a real company\u2019s application. According to Anthropic, the model later recognized it had reached a production environment and abandoned the exercise.<\/p>\n

Vibhum Dubey, a cybersecurity researcher and red teamer, said the PyPI incident may have the biggest implications for enterprise defenders because the affected organization was compromised through a routine security process rather than a vulnerable application. \u201cThe second one is honestly the more interesting story\u2014it got compromised because its own security scanner did exactly what it\u2019s supposed to do, automatically install and scan a new Python package, except the package was one Claude had built and uploaded as part of the test,\u201d Dubey said. \u201cSo a company got breached by following good security practice, which is a pretty uncomfortable detail.\u201d<\/p>\n

Anthropic distinguishes incidents from OpenAI\u2019s<\/h2>\n

Anthropic said its findings differed from OpenAI\u2019s recent disclosure because its models did not exploit a software vulnerability to escape isolation.<\/p>\n

\u201cWhereas OpenAI\u2019s models exploited a novel vulnerability to escape isolation, the Claude models evaluated here accessed the internet via an open path. While there is not a perfectly sharp distinction between the two, we believe these incidents to be closer to a harness and operational failure than a model alignment failure,\u201d the company said in the blog post.<\/p>\n

Anthropic also said the behavior of its newest research model offered \u201ccautious optimism\u201d because it recognized that it had reached a real-world environment and stopped pursuing the evaluation objective.<\/p>\n

Dubey said the two disclosures point to a broader issue with how frontier AI models are being evaluated.
\u201cThis is the second major AI lab in about two weeks to admit a test environment leaked out to the real internet,\u201d he said. \u201cThat\u2019s not really a coincidence anymore. It points to eval environments being treated as lower priority than production systems, even though the whole point of these tests is to see how far a model can push offensive capability with fewer guardrails on.\u201d<\/p>\n

Security experts urge stronger evaluation safeguards<\/h2>\n

The Anthropic and OpenAI disclosures highlight shortcomings in the environments used to evaluate increasingly capable AI models, according to Drew Dennison, co-founder and CTO at Semgrep.<\/p>\n

\u201cWhat is surprising is that labs taking safety this seriously still don\u2019t have a \u2018Fort Knox\u2019 testing sandbox designed to contain models this capable,\u201d Dennison said.<\/p>\n

He added that while AI developers are likely to strengthen their evaluation environments, organizations should prepare for similar capabilities becoming available to attackers.<\/p>\n

\u201cThe industry will shut this kind of activity down, but that won\u2019t stop malicious actors from gaining access to models of this caliber within the next six months and deliberately attempting the same thing,\u201d Dennison said. \u201cDefenders have a limited window to prepare, which makes hardening their software attack surface now so critical.\u201d<\/p>\n

Anthropic said the review has prompted changes to how it conducts cyber capability evaluations.<\/p>\n

\u201cEvaluation environments that involve powerful autonomous capabilities also require significant controls. Safety testing happens before a model is released precisely because we don\u2019t yet know what it is capable of. Evaluation environments increasingly need to be held to the same security standard as any other system our models run in,\u201d the company added in the blog post.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Less than two weeks after OpenAI disclosed that an experimental AI model breached Hugging Face during a cybersecurity evaluation, Anthropic has revealed that its own review uncovered three incidents in which Claude models gained unauthorized access to the production infrastructure of three organizations during similar testing. Anthropic said it launched the review after OpenAI disclosed that one of its experimental models had escaped its evaluation… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16537","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16537","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16537"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16537\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16537"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16537"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}