Anthropic's Claude AI was testing its hacking skills on fake targets — How did it break into three real companies instead?

Anthropic’s Claude AI models managed to break into the systems of three real-world companies during controlled cybersecurity exercises, turning what were supposed to be simulated hacking challenges into genuine security incidents.The unusual breaches were not the result of Claude deliberately breaking out of a secure sandbox. Instead, Anthropic said an operational mistake involving an external evaluation partner accidentally left the AI models connected to the open internet — even though Claude had been instructed to behave as if no such access existed.Once that door was left open, the models did what they had been trained and instructed to do in the cybersecurity tests: search for vulnerabilities, exploit them and retrieve information.The problem was that some of their targets were real.Anthropic discovered the incidents after reviewing 141,006 testing sessions and said three models were involved: Claude Opus 4.7, Claude Mythos 5 and an internal research model that has not been publicly released.The earliest incident dates to April.How Claude ended up hacking real systemsAnthropic had been putting Claude through “capture-the-flag” cybersecurity exercises, a common type of security challenge in which participants are asked to find vulnerabilities and uncover hidden information inside simulated networks.These evaluation environments were deliberately designed with fewer safeguards so researchers could establish how capable Claude had become at offensive cybersecurity tasks.Claude was supposed to believe it was operating inside an isolated environment without access to the public internet.But a configuration mistake involving one of Anthropic’s evaluation partners meant the models could, in fact, reach the web.That seemingly simple failure had significant consequences.With internet access available, Claude began interacting with infrastructure outside the intended test environment and ultimately gained unauthorised access to systems belonging to three organisations.“Claude compromised the impacted organizations' infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints,” Anthropic said.In other words, the AI did not need an exotic new hacking technique. Once accidentally given access to real systems, it was capable of identifying relatively ordinary security weaknesses and exploiting them.A fictional target led Claude to a real companyOne incident involving Claude Opus 4.7 illustrates how quickly the distinction between a simulation and the real internet became blurred.Researchers gave Claude the name of what was supposed to be a fictional company as part of its cybersecurity challenge.There was one problem: a real business happened to have the same name.Claude found the actual company online and discovered vulnerabilities in its systems. It then exploited those weaknesses, obtaining credentials and gaining access to a database.But perhaps the most striking part was how the model interpreted what it had found.Instead of concluding that it had accidentally encountered a real organisation, Claude apparently reasoned that the real-looking infrastructure must simply be another component of Anthropic’s simulated exercise.It therefore continued with the task.The episode highlights a growing challenge for AI safety researchers: a sufficiently capable AI agent may follow an instruction correctly while operating on a fundamentally incorrect understanding of where the boundaries of its environment lie.Another Claude model realised something was wrong — and stoppedA separate incident produced a very different outcome.Anthropic said an unreleased research model also reached a real-world target while undergoing testing. But this time, the AI independently recognised that the system it was interacting with appeared to be real.It stopped the attack on its own.Anthropic said the behaviour provided some reason for cautious optimism that newer models could become better at recognising when an apparently simulated task has crossed into the real world.However, the company stressed that considerably more testing would be required before drawing firm conclusions.The contrast between the two cases is important: one Claude model rationalised away warning signs and continued attacking, while another detected the problem and halted itself.Anthropic calls breaches an ‘operational failure’Anthropic characterised the incidents as an “operational failure” rather than evidence that Claude had independently escaped its restrictions.The distinction separates the Claude incidents from a recently disclosed cybersecurity episode involving rival OpenAI.According to Reuters, an autonomous OpenAI agent independently exploited a previously unknown vulnerability that enabled it to reach the internet during testing. The agent subsequently compromised infrastructure belonging to AI developer platform Hugging Face.In Anthropic’s case, internet access was accidentally provided because of a mistake in the testing setup.Still, the outcome was troubling: AI systems designed to demonstrate their hacking abilities against simulated targets ended up successfully using those capabilities against real organisations.Anthropic suspended its cyber evaluations on July 23 and began notifying affected organisations on July 27. Two of the companies reportedly did not know about the activity until Anthropic contacted them.Irregular, a cybersecurity laboratory that works with Anthropic as a third-party evaluation partner, said it was investigating the incidents.141,006 AI test sessions reviewedAnthropic uncovered the breaches after examining 141,006 evaluation sessions, an extensive review launched after details emerged about OpenAI’s Hugging Face incident.The findings are likely to sharpen questions about how AI companies test increasingly autonomous models.Jeffrey Ladish, executive director of Palisade Research, suggested publicly known incidents may represent only part of the problem.He warned that other AI companies could have experienced similar events that either went undetected or were never publicly disclosed.“This is only going to get worse as the models get smarter,” Ladish said.The concern is that increasingly capable AI agents will not merely identify vulnerabilities. They may become better at independently navigating networks, making decisions and exploiting security weaknesses with minimal human involvement.Claude incident puts AI cybersecurity safeguards under scrutinyThe breaches come as Anthropic, OpenAI and other major AI developers race to build increasingly capable autonomous agents — systems that can perform complicated tasks with limited human supervision.That competition is attracting greater scrutiny in Washington.US President Donald Trump in June directed advisers to develop a voluntary cybersecurity testing framework for the most advanced AI systems, with technology companies expected to contribute to its development.OpenAI CEO Sam Altman has also discussed the recent Hugging Face hacking incident with US senators and is expected to discuss upcoming AI models and testing with the White House.Anthropic, meanwhile, says the Claude incidents demonstrate why both internal testing environments and those operated by external partners need much stronger safeguards.The most significant lesson may be surprisingly straightforward.Claude did not need to “escape” its test environment. A human configuration error opened the door to the real internet — and once that happened, the AI was capable enough to walk through it.(With Reuters inputs)