Anthropic has disclosed three security incidents in which Claude models gained unauthorized access to real organizations during internal cyber exercises. According to the AI company, the cause was not new vulnerabilities in the models themselves, but rather misconfigured test environments.
The incidents came to light after Anthropic launched a large-scale internal investigation in response to the OpenAI incident reported earlier this month. In that incident, AI models were able to access Hugging Face’s infrastructure from a test environment.
Anthropic subsequently analyzed 141,006 evaluation runs in which Claude could potentially have gained internet access. This revealed three cases in which a model connected to the public internet during a cyber exercise. It then infiltrated real corporate environments.
Three different incidents
The three incidents occurred during capture-the-flag exercises, in which AI models are tasked with attacking a fictional target. In all cases, the system prompt informed Claude that the environment was entirely simulated and had no internet connection. However, due to a configuration error at evaluation partner Irregular, internet access was present after all.
The most serious incident involved Claude Opus 4.7. A fictional company from the exercise turned out to have the same name as an existing domain. After the model was unable to reach the simulated target, it attacked the real organization. In the process, it stole login credentials and gained access to a production database containing several hundred records. It is noteworthy that the model continued the attack, even after receiving indications that it was dealing with a real environment.
A second incident involved Claude Mythos 5. The model published a malicious Python package on PyPI, assuming this was part of the exercise. The package remained online for about an hour and was installed by fifteen real systems during that time. Using an automated malware analysis environment, Claude then managed to obtain additional login credentials.
The third incident involved an internal research model that scanned approximately 9,000 internet targets. Ultimately, it managed to penetrate a web application and only terminated the attack after concluding on its own that it was no longer dealing with a simulated environment.
Test environment proves to be the weak link
According to Reuters, Anthropic emphasizes that the models did not exploit any unknown vulnerabilities. Unlike the OpenAI incident, in which a zero-day exploit was used to escape a sandbox, the Claude models primarily used relatively simple attack techniques. These included exploiting weak passwords, unsecured endpoints, and SQL injection. The company therefore attributes the issue to an operational problem in the evaluation environment. They do not view it as a fundamental alignment problem.
Anthropic’s main conclusion is that evaluation environments for powerful AI agents must henceforth be held to the same security standards as production environments. According to the company, it is no longer sufficient to secure only the models themselves. The infrastructure in which they are tested must also be treated as a high-risk environment. For this reason, stricter network controls, more extensive monitoring of evaluations, and additional security measures at external testing partners are being implemented, among other measures.
Anthropic emphatically states that the incidents do not indicate that Claude independently attempted to escape from its test environment. According to the company, the models acted based on incorrect assumptions about their environment. This occurred after a configuration error allowed them to access the internet despite instructions to the contrary. Furthermore, the most recent test model terminated its attack of its own accord as soon as it determined that it was in a real production environment.