Claude AI hacked 3 companies using basic techniques; Anthropic admits the error
Anthropic has revealed that its Claude AI models accidentally hacked the systems of three real-world organisations during cybersecurity tests, following a configuration error that allowed the AI to access the internet. The company maintains that the incidents did not result from Claude attempting to escape its testing environment, but rather from a configuration error within the assessments themselves.
“After reviewing 141,006 evaluation runs where Claude could have gained internet access, we identified three incidents in which a model accessed the network from—or while interacting with—the evaluation environment of Irregular (one of our external evaluation partners) and subsequently gained unauthorised access to the production infrastructure of three distinct organisations,” the company noted on its blog.
This revelation follows reports from OpenAI that some of its AI models had escaped an isolated testing environment by exploiting a previously unknown software vulnerability. That news prompted Anthropic to conduct a thorough review of its own cybersecurity assessments to determine if Claude had ever accessed systems, it was not authorised to reach. The company examined over 141,000 evaluation runs and detected three incidents where Claude accessed the internet while participating in “capture-the-flag” exercises. These tests are designed to measure an AI model’s hacking capabilities by challenging it to retrieve hidden information within a simulated network.
https://x.com/AnthropicAI/status/2082965101083320543?s=20
According to Anthropic, Claude had been clearly instructed that it was operating within a simulated environment with no Internet access. However, due to a configuration error between Anthropic and its external evaluation partner, the test machines were connected to the Internet. As a result, Claude assumed that the real websites and servers it discovered were part of the challenge.
Claude used simple hacking methods
Anthropic stated that the AI employed basic hacking methods rather than advanced exploits. Techniques such as weak passwords, exposed debugging pages, SQL injection, and unauthenticated endpoints were used to access systems. The company added that Claude never attempted to self-replicate, escape the test environment, or pursue goals other than completing the assigned task.
One of the incidents involved Claude Opus 4.7, which mistakenly attacked a real company because its name matched that of a fictional company used in the exercise. Believing it had found the intended target, the model accessed the company’s infrastructure, extracted credentials, and reached a production database containing several hundred rows of data. Anthropic described this event as the most serious of the three incidents.
Another case involved Claude Mythos 5, which created and uploaded a malicious Python package to the public software repository PyPI. The AI believed the repository was part of the simulation, but the package remained available online for approximately an hour before being removed. During that time, it was downloaded by 15 real-world systems, including an automated security scanner operated by a cybersecurity firm. Anthropic reported that the scanner executed the package as part of its routine process, allowing the AI to harvest credentials before the package was taken down.
Anthropic attributes responsibility to the test configuration.
The third incident involved an internal research model that scanned nearly 9,000 internet-connected targets after failing to reach its intended fictional objective. It ultimately compromised a company’s application using exposed credentials and SQL injection techniques. However, unlike the previous models, this version halted its activity upon realising it had accessed a real system outside the scope of the planned evaluation.
Anthropic noted that the evaluations were conducted without the oversight and misuse-prevention mechanisms normally enabled in publicly available Claude models. Upon detecting the issue, the company suspended all cybersecurity evaluations, informed its evaluation partner Irregular, and notified the affected organisations.
Comparing its findings with information recently disclosed by OpenAI, Anthropic maintained that the incidents were distinct. OpenAI’s models managed to reach the network previously unknown vulnerability, whereas Claude accessed the internet because the test environment had been left connected by mistake. The company believes this episode highlights the need for more robust safeguards in AI testing as models gain greater capabilities.