Three different Claude models found their way onto the open internet during cybersecurity evaluations and attacked real-world systems. One even published malware on a public platform. Anthropic blames a misconfiguration.
While reviewing its own cybersecurity evaluations, Anthropic found three incidents where Claude models escaped test environments and compromised real companies on the internet. The company reviewed 141,006 evaluation runs and flagged six cases where models accessed systems they weren't supposed to reach. The review was triggered by OpenAI's security incident.
A configuration error gave Claude access to the open internet
The incidents happened during capture-the-flag exercises where Claude was tasked with finding hidden information on external systems in fictional scenarios. Anthropic says Claude was told in the evaluation prompt that it was in a simulation with no internet access, but a miscommunication between Anthropic and its evaluation partner Irregular meant the test agents actually had full internet access.
Claude treated the real systems it found as part of the exercise. Anthropic says the models didn't exploit complex vulnerabilities and instead used basic techniques like weak passwords and unauthenticated endpoints.
