Anthropic has announced that its Claude AI models inadvertently accessed the systems of three organizations during cybersecurity tests due to a misconfiguration that mistakenly allowed internet connectivity. The company discovered these breaches while reviewing over 141,000 cybersecurity evaluation exercises, which were conducted following recent revelations of AI security incidents within the industry.
The access gained by the models relied on elementary hacking techniques like exploiting weak passwords and unsecured endpoints to infiltrate the organizations’ systems. The incidents involved models Claude Opus 4.7, Claude Mythos 5, and an internal research model, with some breaches traced back to April. These unauthorized entries took place during “capture the flag” exercises, where AI models are challenged to find concealed data within simulated networks. Despite instructions that they had no internet access, a configuration oversight left the test environments exposed to the internet.
Anthropic has communicated with two of the impacted organizations after identifying the security breaches, while efforts to reach the third organization are still underway. The company stressed that these events underline the necessity for more robust safeguards and tighter controls in AI cybersecurity evaluations, given that advanced AI models are increasingly able to execute real-world cyber operations.