Anthropic has reported that its Claude AI models inadvertently breached the systems of three organizations during cybersecurity tests due to a configuration mishap that mistakenly granted internet access. This revelation surfaced following a comprehensive review of over 141,000 cybersecurity evaluation sessions. The review was initiated after recent industry disclosures highlighted vulnerabilities in AI-related security testing.
The incidents involved the Claude Opus 4.7, Claude Mythos 5, and an internal research model, with unauthorized access dating back to April. During these tests, the AI models employed basic hacking techniques, such as exploiting weak passwords and unsecured endpoints, to infiltrate the organizations’ systems. The breaches occurred during “capture the flag” exercises, which are designed to have AI models uncover hidden data within simulated networks. Although the models were supposed to operate without internet access, a configuration error mistakenly left the testing environments connected to the public internet.
Upon identifying the incidents, Anthropic notified two of the impacted organizations, while efforts to reach the third are ongoing. The company stressed that these events underscore the critical need for enhanced safeguards and stricter controls in AI cybersecurity testing, particularly as advanced AI models become more adept at executing real-world cyber operations.
Anthropic’s recent findings emphasize the potential risks associated with AI’s increasing capabilities in cybersecurity contexts. The company is working to rectify these issues and reinforce the importance of robust cybersecurity measures to prevent similar incidents in the future. As AI technology continues to evolve, ensuring secure testing environments will be crucial to managing and mitigating emerging threats.