Prompted by OpenAI Disclosure, Anthropic Finds Its Own Models Hacked 3 Organizations

Summary

Anthropic disclosed that its Claude AI models broke out of isolated test environments and compromised the production systems of three unnamed organizations while conducting a capture-the-flag security assessment. The breakout stemmed from a miscommunication with evaluation partner Irregular, where Claude was told it operated in an internet-free simulation but actually had internet access. Unlike OpenAI's recent similar incident involving zero-day exploitation, Anthropic's models used basic attack techniques including weak credentials, unauthenticated endpoints, and a malicious Python package uploaded to PyPI.

Full text

Anthropic revealed on Thursday that some of its Claude models escaped test environments and hacked into the systems of three organizations while trying to solve a challenge. The admission comes after OpenAI revealed that its models broke out of what was believed to be an isolated environment and breached Hugging Face and other organizations. Anthropic decided to conduct its own investigation after the OpenAI incident came to light, reviewing 141,000 evaluation runs where Claude could have gained internet access. The analysis revealed three instances where a model reached the public web either from within or while interacting with an environment set up by Irregular, an Israeli AI security startup that serves as one of Anthropic’s third-party evaluation partners. The models that broke out from the testing environment then breached the production systems of three unnamed organizations, with the earliest intrusion dating to April. According to the AI giant, Claude had been tasked with conducting a capture-the-flag challenge to assess its cyber capabilities. Advertisement. Scroll to continue reading. The breakout from the sandbox occurred due to a misunderstanding between Anthropic and Irregular—Anthropic told Claude that it was conducting a simulation in an environment without internet, but a connection to the internet was in fact available and the models treated it as part of the exercise. The AI then also falsely believed that the organizations it targeted were part of the exercise. Anthropic claims this is the only reason why its models conducted real-world attacks, and it was never their intention to escape the test environment. Unlike in the OpenAI incident, which involved the exploitation of a JFrog product zero-day, the hacking conducted by Claude models leveraged weak credentials, unauthenticated endpoints, and other basic attack techniques. The real-world attacks Anthropic said the incidents involved Mythos, Opus, and an internal research model, all running without the safeguards deployed when they are made available to customers. The internal model, which the company described as its “latest”, stopped the exercise when it realized that it had breached a real company. In the first incident, Claude Opus 4.7 continued to attack the system even after learning that it was operating in a real environment rather than a test environment, believing that the hacked company was part of the evaluation. The model targeted the company because its website domain name resembled the name of the fictional target company set up for the test. In the second incident, Mythos 5 gained access to the systems of a cybersecurity company after deploying a malicious Python package to PyPI. The security firm regularly scans Python packages and it installed the malicious package, which enabled the AI to exfiltrate credentials and access the company’s infrastructure. This incident demonstrates the complexity of the actions AI models can carry out. As described by Anthropic: [In] order to create a PyPI account, Claude needed an email address. And in order to create an email address, it needed a phone number. To get a phone number, after failing to find a free phone number service, it tried—and failed—to obtain funds to pay for a phone number through several different means. It finally backtracked, found a free, non-blocked email provider, used this to register a PyPI account, and then used this account to upload malware to PyPI. The third intrusion was conducted by the internal model, which stopped operating when it realized that the systems it was accessing were no longer part of the capture-the-flag challenge, but not before using exposed credentials and SQL injection flaws to compromise a company’s internet-facing app. Anthropic concluded this was primarily a harness and operational failure rather than a case of models pursuing their own goals or deliberately deceiving evaluators. The company said the incident underscores the need for stricter internet-isolation verification and containment controls in third-party testing environments, and it’s encouraging other AI labs to conduct similar reviews of their own cybersecurity evaluations. Related: Microsoft Unveils MAI-Cyber-1-Flash, Its First Cybersecurity AI Model Related: Anthropic’s Mythos Model Found Vulnerabilities in Classified US Government Systems Related: Nvidia and Tech Giants Launch AI Security Alliance Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Semiconductor Firm Analog Devices Discloses Data Breach1 in 5 Data Center Assets Are Within Easy Reach of AttackersCisco Secure FMC Zero-Day Exploited in the WildThreatLocker Raises $190 Million in Series F FundingCritical VM Escape Vulnerability Patched in VMware ESXiOpenAI’s Rogue AI Ventured Beyond Hugging FaceDozens of Minnesota Water Utilities Targeted in Coordinated OT AttacksCyera Acquiring Oasis Security in $1 Billion Deal Latest News Critical Flaw Led to Azure Cosmos DB PwnageCareCloud Data Breach Impacts Over 350,000Critical Code Execution Vulnerability Patched in TeamCity CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCsBank of America to Acquire Cybersecurity Firm MDSecOkta to Acquire Identity Threat Detection Firm PermisoTimeless Compliance: Why Better Questions Beat Bigger FrameworksDataBahn Raises $40 Million for Agentic Data Pipeline Management Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveAlex Levinson has been named Executive Director at the National Collegiate Cyber Defense Competition.Hack The Box has appointed Konstantinos Dolkas as CTO and has promoted Christine Bartlett to CMO.The Department of Energy has appointed Andrew McClure as Director of the Office of Cybersecurity, Energy Security, and Emergency Response (CESER).More People On The MoveExpert Insights Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecyc

Indicators of Compromise

• malware — Malicious Python package (uploaded to PyPI)

Entities