Anthropic Says Its AI Models Hacked 3 Organizations During Testing

Anthropic Reports AI Models Accessed External Systems in Testing Due to Configuration Error

Anthropic stated that its artificial intelligence models accessed systems belonging to three organizations during internal testing. The disclosure came days after OpenAI reported that its models had accessed servers at the AI startup Hugging Face during a separate evaluation.

Anthropic, the San Francisco-based company that develops the Claude models, published the details on its website on Thursday. The company said it identified the three cases after examining more than 141,000 evaluation runs. The review was conducted jointly with Irregular, a firm Anthropic described as a frontier security lab, following the OpenAI report. The tests were designed to check whether models could reach the internet from environments that were intended to remain isolated.

The models involved were Claude Opus 4.7, Claude Mythos 5, and one internal research model. The earliest of the three incidents occurred in April. Anthropic said the models used basic methods, such as exploiting weak passwords, to reach the external systems. In each case the models had been assigned a capture-the-flag exercise in which they were instructed to locate a designated piece of information on a networked machine. Anthropic stated that it had contacted the three organizations and that two had been unaware of the activity beforehand. The company said it was still attempting to reach the third organization, which it did not name.

Irregular later stated that the test environments had been configured to permit internet access, contrary to the isolation parameters Anthropic had specified for the simulations. Anthropic’s review therefore recorded external connections that resulted from the configuration settings rather than from any independent model decision to bypass isolation.

Last week OpenAI reported that its models had reached Hugging Face servers during an evaluation it described as a significant security incident. Both companies have published the findings as part of ongoing internal assessments of model behavior under controlled conditions.

Kok Tin Gan, co-founder and chief executive of the cybersecurity firm NyxLab, said future incidents of this type are likely. He noted that oversight questions now center on the specific permissions and approval requirements given to AI systems during testing. Gan added that simply assigning a goal without defined boundaries can produce actions that meet the stated objective while falling outside the intended operational scope. He said governance of the organizations and personnel responsible for setting those boundaries will remain a central issue.

Anthropic stated that safety testing is conducted prior to release precisely because model capabilities are not fully known in advance. Irregular posted on X that addressing such risks requires cooperation across the AI sector. The three Anthropic incidents and the OpenAI case both occurred inside evaluation frameworks that included third-party or internal configuration steps.