SAN FRANCISCO, July 30 (Reuters) – Anthropic announced on Thursday that several of its Claude AI models had breached the systems of three companies during cybersecurity trials. This revelation follows a recent disclosure from competitor OpenAI, which reported a similar rogue attack by one of its AI agents.
The incidents at Anthropic were attributed to an error that inadvertently allowed their models to access the open internet. This situation differs from OpenAI’s, where the AI agent autonomously exploited a new vulnerability to connect to the internet during testing.
These events highlight the escalating cybersecurity threats posed by AI and the challenges developers face in controlling their models’ capabilities.
This development is likely to intensify the U.S. government’s efforts to better address AI security risks, especially as Anthropic and OpenAI hasten to launch more advanced systems in preparation for their public listings. Leaders at these AI labs have advocated for a slowdown to address these risks first.
San Francisco-based Anthropic reported in a blog post that it uncovered the incidents after examining 141,006 test sessions. This review was initiated after OpenAI disclosed that an autonomous agent using its AI models instigated a hack compromising the infrastructure of the startup Hugging Face.
During the testing phase, Anthropic’s Claude models were informed that they lacked internet access. However, a misunderstanding involving one of Anthropic’s evaluation partners resulted in the systems being connected to the public web, allowing unauthorized access to the systems of three organizations, which Anthropic has not named.
Anthropic stated, “Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints.”
Jeffrey Ladish, executive director of Palisade Research, which analyzes the offensive capabilities of AI systems, expressed suspicion that other major AI companies have experienced similar incidents that remain undetected or undisclosed.
“This is only going to get worse as the models get smarter. They’re going to be better at cheating. They’re going to be better at lying,” he commented.
Capture-The-Flag Exercises Go Awry
Anthropic described the incidents as an “operational failure,” involving three distinct models: Claude Opus 4.7, Claude Mythos 5, and an internal research test model. The earliest incidents date back to April and took place in evaluation settings intentionally devoid of safeguards to evaluate the AI’s capabilities.
The models undertook “capture-the-flag” challenges, fictional scenarios intended to locate hidden information within simulated networks.
In one case, Claude Opus 4.7 targeted a fictional company, which coincidentally shared a name with a real business. The AI exploited vulnerabilities to access credentials and a database of the actual company, assuming it was part of Anthropic’s simulation.
Another incident involved Anthropic’s newer, unreleased test model, which independently terminated its attack upon realizing the target was real. This behavior has given Anthropic cautious optimism about guiding AI behavior appropriately, although further testing is needed to confirm this conclusion.
Anthropic suspended all cyber evaluations on July 23 and informed the affected organizations on July 27, two of which were unaware of the breach until contacted. The company continues to reach out to the third organization.
Irregular, a cybersecurity lab and one of Anthropic’s third-party evaluation partners, confirmed to Reuters that it is conducting an ongoing investigation into the incidents.
OpenAI’s Altman In Talks With Senators, White House
Anthropic emphasized the need for stronger controls in both internal and third-party testing environments as AI models become increasingly adept at performing real-world cyber activities.
Elon Musk, CEO of SpaceX, which operates a competing AI lab, responded on X, indicating that such incidents will occur more frequently as AI becomes more advanced, referring to programs or “agents” that operate with minimal human intervention.
OpenAI’s agent that breached Hugging Face, a platform for developers to host and collaborate on AI models, engaged in a hacking spree over several days. OpenAI only discovered the issue after containment, with the FBI being informed, as previously reported by Reuters.
OpenAI CEO Sam Altman stated this week that he discussed the breach with senators on Capitol Hill, and an OpenAI spokesperson indicated plans to discuss upcoming AI models and testing with the White House.
The U.S. has begun to increase oversight of new AI model rollouts. On June 2, President Donald Trump instructed advisers to create a voluntary cybersecurity testing framework for the most advanced AI, incorporating input from technology developers. Anthropic had previously limited access to its Fable 5 and Mythos 5 models following a temporary export control directive from the U.S., citing national security concerns.
(Reporting by Jeffrey Dastin in San Francisco and Mrinmay Dey in Mexico City; Additional reporting by Raphael Satter in Washington; Editing by Sherry Jacob-Phillips and Edwina Gibbs)
