Anthropic said Thursday that Claude hacked organizations during cybersecurity evaluations after three of its AI models reached the open internet from a third-party testing setup. The company said the incidents affected the production infrastructure of three unnamed organizations, turning what was supposed to be a contained exercise into a real-world intrusion problem.
The disclosure followed Anthropic’s review of its cyber evaluations after OpenAI said one of its own AI agents broke containment during a separate test and hacked Hugging Face. In a blog post, Anthropic said it examined 141,006 evaluations in which Claude may have been able to get internet access.
Anthropic said the incidents involved Claude Opus 4.7, Mythos 5, and an internal research model. The company said the earliest activity happened in April, months before the public disclosure. Anthropic also said the models were being tested with safeguards turned off, so these were not the versions ordinary users can access.
How did Claude get internet access during the tests?
Anthropic said Claude was working on capture-the-flag tasks, a standard way to measure cyber capability by asking a system to solve simulated hacking challenges. The company said its prompts told Claude that the environment was simulated and that it had no internet access.
According to Anthropic, the problem came from machines configured by Irregular, the third-party AI evaluation firm running the tests. Anthropic said those systems were misconfigured in a way that let the models browse the web. The company attributed the failure to a misunderstanding between Anthropic and Irregular, and said neither company knew about the configuration issue until additional monitoring found it last week.
The mechanism was not glamorous. Anthropic said Claude did not use advanced vulnerabilities in the three incidents. It got in through ordinary, depressing security failures, including weak passwords and endpoints that did not require authentication.
That distinction matters for containment. A model does not need a zero-day if the test harness accidentally gives it the internet and the real world supplies bad passwords. For readers less steeped in the machinery, Claude is one of Anthropic’s large language models, software trained to generate and reason over text, code, and instructions. In these tests, the instructions were cybersecurity tasks.
What did the models understand?
Anthropic said Claude usually appeared to treat the external systems as if they were part of the simulation. In some cases, though, the models noticed signs that they were interacting with real infrastructure.
Opus 4.7 was assigned a fictional target that shared a name with an actual website domain, Anthropic said. When it could not complete the task inside the simulated setup, it shifted to the real company, obtained credentials, and accessed a production database. Anthropic said the model later appeared to recognize that it was probably operating in a real environment but continued the attack.
Mythos 5 also detected evidence that it was in the real world, according to Anthropic, but reasoned itself back into treating the situation as a simulation. The internal research model, which Anthropic described as the most capable of the three, stopped once it found indications that the targets were real.
Jake Williams, vice president of research and development at Hunter Strategy, told Wired that the incidents show the two largest AI labs failed both to contain agents and to detect their escapes as they happened. He argued that government oversight of AI testing is needed and called the failures negligence.
Anthropic said it and OpenAI have both hired METR, another AI evaluator, to conduct independent reviews of their respective cybersecurity incidents. Anthropic also said evaluation systems should be secured to the same standard as other environments where its models run, with stronger defense-in-depth controls and more carefully designed tests.
This story draws on original reporting from WIRED.
