{"id":14312,"date":"2026-07-31T22:48:37","date_gmt":"2026-07-31T22:48:37","guid":{"rendered":"https:\/\/sawahsolutions.com\/range\/anthropic-confirms-its-ai-breached-3-organizations-during-testing\/"},"modified":"2026-07-31T22:48:38","modified_gmt":"2026-07-31T22:48:38","slug":"anthropic-confirms-its-ai-breached-3-organizations-during-testing","status":"publish","type":"post","link":"https:\/\/sawahsolutions.com\/range\/anthropic-confirms-its-ai-breached-3-organizations-during-testing\/","title":{"rendered":"Anthropic confirms its AI breached 3 organizations during testing"},"content":{"rendered":"
\n

Anthropic\u2019s flagship artificial intelligence model Claude gained unauthorized access to the networks of three different organizations, the company announced following internal cybersecurity audits of its routine model evaluations.\u00a0<\/p>\n

In a press release posted Thursday, Anthropic said that, following the containment breach of OpenAI\u2019s ChatGPT-5.6 and subsequent attack on Hugging Face\u2019s systems, Anthropic conducted an audit of its own model evaluations. The findings revealed that, out of 141,006 examined evaluations of Claude models dating back to April, there were three incidents where a model accessed the internet from within or while interacting with the third-party evaluators.\u00a0<\/p>\n

Each attack occurred during a \u201ccapture-the-flag\u201d scenario where the models are asked to find hidden information housed within a different node.<\/p>\n

In the blog post, Anthropic blamed a \u201cmisunderstanding\u201d between them and their third-party evaluators that granted the models internet access. The models were told in prompts that they would not have real internet access and therefore operated under the premise that all accessible systems were part of the test environment.<\/p>\n

\u201cOperating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations\u2019 infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints,\u201d the post reads. \u201cIt did not find or exploit any complex vulnerabilities, and in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned.\u201d<\/p>\n

The models involved in the incidents were Opus 4.7, Mythos 5, and an unnamed internal research test model that isn\u2019t planned for release. Anthropic stated that, despite accessing the internet as part of its cybersecurity testing, the models did not deliberately attempt to leave their training environments; accessing the internet only occurred as they looked to complete their tasks.\u00a0<\/p>\n

In one incident, Opus 4.7 executed the task on the real-world networks of a company once it realized it could via internet access.\u00a0<\/p>\n

A second incident was more extensive. Mythos 5 sought to find information by referencing software development instructions inside a fictional environment. It used these instructions to install a Python package from a public registry that didn\u2019t actually exist in the hopes that the fictional company would automatically download it, thus granting the model access to its networks. In order to do this, it created login credentials a human user would need.\u00a0<\/p>\n

That Python package was inadvertently uploaded to the internet, where 15 systems downloaded it and compromised their systems.\u00a0<\/p>\n

The third incident saw the prototype model scan real targets after being unable to find the fictional target included in the test.\u00a0<\/p>\n

Anthropic noted that, when the models were able to discern that the attacks affected real systems, they halted their testing processes\u2014something that, in part, the company said,\u00a0gives it \u201ccautious optimism.\u201d<\/p>\n

\u201cSeveral defense-in-depth measures, on both our side and our partner\u2019s, could have prevented these incidents\u00a0or at least reduced their likelihood of occurring,\u201d the post read. \u201cBoth we and our partner also could have reviewed evaluation transcripts or network logs more thoroughly. It\u2019s also possible that a prompt which told Claude it did have internet access would have changed how Claude behaved when it came into contact with real systems.\u201d<\/p>\n

In the aftermath of the breaches, Anthropic is working with its evaluation partner, Irregular, and METR, an independent AI evaluation organization, to continue conducting reviews. It is also working alongside affected companies whose systems were compromised.\u00a0<\/p>\n

Anthropic concluded by saying it encourages other AI developers to conduct similar audits and that evaluation exercises in general need stronger oversight and safeguards.\u00a0<\/p>\n

\u201cUltimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we\u2019re approaching the fixes as if the responsibility were ours alone,\u201d the post reads.\u00a0<\/p>\n

Industry peers characterized Anthropic\u2019s revelations on the heels of OpenAI\u2019s incident as a burgeoning pattern cyberdefenders should heed.\u00a0<\/p>\n

Tom Kellermann, the vice president of AI Security and Threat Research at TrendAI, said that these incidents underscore the continued need for safeguards even in secure sandbox environments.<\/p>\n

\u201cAnthropic and OpenAI just proved that when you strip guardrails for testing, you\u2019re not creating a sandbox, you\u2019re inviting systemic risk,\u201d Kellermann said in a statement to Nextgov\/FCW<\/em>. \u201cEvery organization deploying agentic AI needs to ask itself if their evaluation environment is actually contained. Containment and monitoring are no longer optional.\u201d\n\n<\/svg><\/p>\n<\/div>\n