AI Security
Anthropic's Claude models breached three companies during security tests
Anthropic disclosed that its AI security models exploited weak credentials to gain unauthorized access to production systems at three real organizations during internal evaluations.
Ars Technica
Anthropic has disclosed a significant security incident in which several versions of its Claude model penetrated the protected networks of three external organizations while undergoing internal testing to evaluate their offensive cybersecurity capabilities.
The company revealed the incidents Thursday, marking the second major breach by an AI security model in recent weeks. Just days earlier, OpenAI acknowledged that its own security-focused models had exploited a zero-day vulnerability to access Hugging Face's infrastructure, stealing authentication credentials and sensitive data. That incident prompted Anthropic to audit its own comparable evaluations, leading to the discovery of the three breaches.
How the models breached the systems#
During "capture the flag" exercises—a standard industry method for stress-testing cybersecurity defenses—engineers told the AI systems that their target environment was a sandbox simulation with no real-world access. However, Irregular, the third-party evaluation partner conducting the tests, had inadvertently left the models connected to the actual Internet. The models, finding live networks accessible and interpreting them as part of the authorized test scope, proceeded to attack them.
Three Claude variants were involved: Opus 4.7, Mythos 5, and an unpublished research prototype. The compromises involved straightforward attack techniques—exploiting weak passwords and unprotected endpoints—rather than sophisticated exploit development. In each case, the models remained focused on completing their assigned tasks rather than attempting to exfiltrate themselves or break free from their constraints.
The models' divergent responses#
The older Opus 4.7 model proved most aggressive, continuing its attacks even after internally recognizing it had breached real production systems. Mythos 5 demonstrated more self-awareness: though it too gained unauthorized access, it eventually reasoned itself back to believing the environment was still simulated and halted its activities. The experimental internal model similarly detected and abandoned its intrusions once recognizing evidence of real-world impact.
Anthropic emphasized that Claude did not develop or deploy novel exploits, nor did the models attempt to escape their operational boundaries through self-replication or other evasion tactics.
