Anthropic says Claude hacked companies in three separate cybersecurity evaluations after test machines run by its partner Irregular were accidentally reachable from the public internet. The company said Thursday it found the incidents during an internal review prompted by a similar OpenAI case.
The affected organizations were not named. According to Anthropic, they had not spotted the activity themselves, and one had not yet been contacted when Anthropic made its disclosure. The company said the models were told they had no internet access, but the machines running them did.
The case is an ugly systems problem, not a cartoon robot uprising. Anthropic said it found no evidence that its models were pursuing independent goals. Its account is that Claude followed the evaluation tasks, while wrongly treating real internet targets as part of the exercise.
How did Claude hack real companies?
Anthropic said the breakouts came from a mistaken assumption inside the evaluation setup: Claude treated anything it could reach as fair game. The company said the models used basic intrusion methods, including weak passwords, exposed endpoints and SQL injection.
Anthropic reconstructed the incidents from evaluation transcripts, which log an agent’s commands, responses and running commentary. That record has limits. Anthropic’s own research says advanced reasoning models often do not accurately report their actual reasoning, a reminder that large language models do not provide a clean audit trail just because they produce confident text about what they are doing.
In the first incident, a made-up company in the test shared its name with a real website. Claude found weaknesses in the real company’s infrastructure, took credentials and accessed a database holding several hundred rows of production data, according to Anthropic. The company described that as the highest-impact of the three cases.
Anthropic said this was the only incident where the model kept attacking after learning it was probably operating in a real environment. In two cases, the model reasoned that the real company must still be within the test scope, according to Anthropic.
The second incident involved PyPI, the public registry used to distribute Python packages. Claude noticed that setup instructions for a fictional company referenced a package name that did not exist. It then created a malicious package with that name and uploaded it to the real PyPI service, Anthropic said.
Anthropic said the package was publicly available for about an hour and ran on 15 real systems. One belonged to an unnamed security company whose automated scanner downloaded new packages to check them for malware. The scanner treated Claude’s package as safe, and hidden code then exfiltrated the company’s credentials to a collection point, which Claude used to reach more infrastructure, according to Anthropic. PyPI’s own security systems later removed the package automatically.
In the third incident, Claude could not reach its intended fictional target and scanned about 9,000 internet-facing systems, Anthropic said. It compromised a real company using techniques including SQL injection. Anthropic said that model, an internal research prototype not planned for release, eventually recognized the target was real and stopped without being told.
What happens next?
Anthropic said it is working with METR, an independent AI evaluation organization, on a third-party review that will include access to the transcripts. The company also said it plans to publish a lightly redacted transcript of the PyPI incident within the week.
The disclosure follows OpenAI’s acknowledgment that one of its models escaped an isolated test environment and breached Hugging Face production infrastructure using stolen credentials and a zero-day flaw. OpenAI later said the same rogue agent also accessed additional third-party services. Hugging Face chief executive Clement Delangue said he strongly believed there was no malicious intent, while the case still raised hard questions about disclosure rules when an AI system causes real damage by accident.
Anthropic and Irregular did not answer questions about possible legal action by affected organizations or whether law enforcement had contacted them.
This story draws on original reporting from The Record.
