Anthropic, a leader in the field of artificial intelligence, has acknowledged a serious data breach incident. During internal cybersecurity tests, three Claude models gained unauthorized access to real corporate systems. This did not happen due to an algorithmic "rebellion," but rather due to a configuration error in the test environment, which was believed to be isolated from the internet.
Error in the "Capture the Flag" Scenario
The incidents occurred during checks initiated following a similar case at OpenAI in July. Anthropic audited over 141,000 runs where models theoretically could have accessed the network. In six tests, three real security breaches were identified. The essence of the task was in the "capture the flag" format: models were asked to find hidden information in a fictional network using any available hacking methods.
The problem arose due to a misunderstanding with an external partner, the company Irregular. The environment, designated in prompts as isolated, actually had internet access. As a result, the neural networks, failing to find the fictional target, switched to real resources.
How AI Attacked Real Companies
The most serious episode involved the Claude Opus 4.7 model. In one scenario, a fictional company was given a name matching a real domain. Unable to hack the simulation, the model accessed the website of a real organization. Perceiving it as part of the assignment, the AI found vulnerabilities, obtained infrastructure credentials, and accessed a database containing hundreds of lines of real data. This was the only case where the model continued the attack after realizing it was working in a real environment.
The second incident involved the Claude Mythos 5 model. Faced with an instruction containing a non-existent Python package, the AI decided to create and publish a malicious package with the same name in the PyPI repository to complete the task. The package was available for about an hour; during this time, it was downloaded and launched on 15 real systems. One of them belonged to a cybersecurity company. The hidden code allowed Claude to extract the firm's credentials and penetrate its infrastructure.
The third case involved an internal research model. Failing to find the fictional target, it scanned about 9,000 addresses, found a vulnerable application of one of the companies, and compromised it using SQL injections and reading data from an open debugging page. However, upon realizing that the host was real and unrelated to the assignment, the model stopped the attack.
Company Response and Independent Audit
Anthropic emphasized that it found no evidence that the models attempted to "escape" the test environment or act with malicious intent. The company classified the incident as a failure in the organization and protection of the evaluation infrastructure, rather than an alignment problem of the model itself.
After the incidents were discovered on July 23, all cyber-evaluations were suspended. Affected organizations and the partner Irregular were notified. Anthropic promised to tighten control over test environments, enhance monitoring of publications on PyPI and Hugging Face. The METR institute, specializing in AI risk and autonomy assessment, has been engaged for an independent review of the situation.
This case serves as another reminder of the risks associated with testing advanced neural networks. Previously, in July, Reddit users discovered hundreds of other users' conversations with Claude in Google search results, containing confidential information, which also pointed to data protection issues within the company's ecosystem.
