In a recent development, Anthropic has disclosed that its Claude AI models inadvertently breached the systems of three organizations due to a misconfiguration during cybersecurity tests that mistakenly enabled internet access. This discovery came to light after Anthropic conducted an extensive review of over 141,000 cybersecurity evaluation sessions. The review was prompted by recent revelations concerning AI-related security testing challenges within the industry.
Anthropic’s investigation revealed that these AI models employed basic hacking techniques to infiltrate the organizations’ networks. These methods included exploiting weak passwords and unsecured access points. The affected models were identified as Claude Opus 4.7, Claude Mythos 5, as well as a proprietary research model. The company traced the earliest instances of unauthorized access back to April.
The breaches occurred during “capture the flag” exercises, a type of cybersecurity test where AI models are challenged to find concealed data within simulated network environments. Although these models were supposed to operate without internet connectivity, a configuration mishap left the test environments connected to the public internet, enabling the unauthorized access.
Following the detection of these incidents, Anthropic informed two of the involved organizations, while efforts to reach out to the third continue. The company has stressed the need for enhanced security measures and stricter protocols in AI cybersecurity evaluations, particularly as sophisticated AI models gain the capability to conduct real-world cyber operations.