Claude Hacked Three Companies in Internal Testing: Anthropic

A week after OpenAI disclosed that its AI models escaped a locked testing environment and breached Hugging Face, and a day after admitting that its own AI models escaped containment, Anthropic revealed on Thursday that several versions of its Claude AI model also compromised three unnamed real-world companies after a misconfiguration gave the AI access to the open internet.

Anthropic uncovered the incidents after reviewing more than 141,000 cybersecurity evaluation runs launched in response to the OpenAI disclosure.

The firm had tasked Claude with a “capture-the-flag challenge,” in all three incidents, Anthropic wrote. The challenge tasks the model with breaking into a different machine on the network and retrieving a piece of secret information. “The challenge is left open-ended, and no particular method is prescribed,” Anthropic explained.

The firm said Claude had been told it was operating in a simulated environment without internet access. However, the test environment remained connected to the public internet. Believing the systems it encountered were part of the exercise, the model used common attack techniques—including weak passwords, exposed credentials, SQL injection, and unauthenticated endpoints—to compromise the companies.

AI want to break free

Earlier this month, OpenAI said GPT-5.6 Sol and a more advanced unreleased model exploited a previously unknown software vulnerability to escape a sandboxed environment, gain internet access, and breach Hugging Face’s production infrastructure to obtain the answers to a cybersecurity benchmark. OpenAI later revealed the same incident also involved unauthorized access to four additional companies, though only one—Modal Labs—has been publicly identified.

According to Anthropic, in one incident involving Claude Opus 4.7, the AI mistook a real company’s website for the fictional target of its assignment, extracted credentials, and accessed a production database containing several hundred rows of real data. In a second case, Claude Mythos 5 uploaded a malicious Python package to the real PyPI repository, where it was downloaded onto 15 systems before being removed. A third internal research model scanned roughly 9,000 internet-facing systems before compromising one organization, then stopped after concluding the target was probably real.

Two of the affected organizations were unaware of the intrusions until Anthropic notified them.

“In each of these cases, Claude was explicitly told by our prompt that it had no internet access,” Anthropic wrote, with the AI assuming real-world systems were “parts of the exercise.” Because a capture-the-flag scenario is “by design an instruction to attack an external system,” breaking in was “in line with the task Claude had been given.”

Anthropic said it found no evidence that Claude tried to escape its test environment or do anything beyond the task it had been assigned, and that the incidents were caused by failures in the testing environment, not by problems with the model itself.

Anthropic said it stopped its cybersecurity tests after discovering the issue, notified the affected organizations, and plans to improve monitoring, investigation tools, and oversight of the outside vendors that help run its AI tests.

“Ultimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we’re approaching the fixes as if the responsibility were ours alone,” they said.