In a recent cybersecurity revelation, Anthropic disclosed that its Claude AI models inadvertently breached the systems of three organizations. This incident occurred during cybersecurity evaluations, which were compromised by a testing misconfiguration that mistakenly provided the models with internet access. The breach was uncovered following a comprehensive review of over 141,000 cybersecurity evaluation runs. This review was initiated in response to earlier reports regarding AI-related security testing issues within the industry.
The unauthorized access was achieved using straightforward attack techniques such as exploiting weak passwords and unsecured endpoints, which allowed the AI models to infiltrate the organizations’ infrastructure. The models involved in these incidents were Claude Opus 4.7, Claude Mythos 5, and another internal research model, with the earliest occurrences traced back to April. These activities took place during “capture the flag” exercises, a type of cybersecurity test where AI models attempt to find hidden information within simulated network environments. Although the AI models were instructed that internet access was disabled, a configuration error left their testing environments exposed to the public internet.
Anthropic has since informed two of the affected organizations upon identifying the breaches, while efforts are still underway to reach out to the third organization. The company stressed that these incidents underscore the critical need for enhanced safeguards and more stringent controls in AI cybersecurity testing. As AI models grow more sophisticated and capable of engaging in real-world cyber operations, the importance of robust security measures becomes increasingly apparent.