Three Claude models were inadvertently given access to the internet during security evaluations, and each model took a different approach to hacking external systems.
Anthropic’s flagship artificial intelligence model Claude gained unauthorized access to the networks of three different organizations, the company announced following internal cybersecurity audits of its routine model evaluations.
In a press release posted on Thursday, Anthropic said that, following the containment breach of OpenAI’s ChatGPT-5.6 and subsequent attack on Hugging Face’s systems, Anthropic conducted an audit of its own model evaluations. The findings revealed that, out of 141,006 examined evaluations of Claude models dating back to April, there were three incidents where a model accessed the internet from within or while interacting with the third-party evaluators.
Each attack occurred during a “capture-the-flag” scenario where the models are asked to find hidden information housed within a different node.
In the blog post, Anthropic blamed a “misunderstanding” between them and their third-party evaluators that granted the models internet access. The models were told in prompts that they would not have real internet access and therefore operated under the premise that all accessible systems were part of the test environment.
“Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints,” the post reads. “It did not find or exploit any complex vulnerabilities, and in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned.”
The models involved in the incidents were Opus 4.7, Mythos 5, and an unnamed internal research test model that isn’t planned for release. Anthropic stated that, despite accessing the internet as part of its cybersecurity testing, the models did not deliberately attempt to leave their training environments; accessing the internet only occurred as they looked to complete their tasks.
In one incident, Opus 4.7 executed the task on the real-world networks of a company once it realized it could via internet access.
A second incident was more extensive. Mythos 5 sought to find information by referencing software development instructions inside a fictional environment. It used these instructions to install a Python package from a public registry that didn’t actually exist in the hopes that the fictional company would automatically download it, thus granting the model access to its networks. In order to do this, it created login credentials a human user would need.
That Python package was inadvertently uploaded to the internet, where 15 systems downloaded it and compromised their systems.
The third incident saw the prototype model scan real targets after being unable to find the fictional target included in the test.
Anthropic noted that, when the models were able to discern that the attacks affected real systems, they halted their testing processes — something that, in part, the company said, gives it “cautious optimism.”
“Several defense-in-depth measures, on both our side and our partner’s, could have prevented these incidents or at least reduced their likelihood of occurring,” the post read. “Both we and our partner also could have reviewed evaluation transcripts or network logs more thoroughly. It’s also possible that a prompt which told Claude it did have internet access would have changed how Claude behaved when it came into contact with real systems.”
In the aftermath of the breaches, Anthropic is working with its evaluation partner, Irregular, and METR, an independent AI evaluation organization, to continue conducting reviews. It is also working alongside affected companies whose systems were compromised.
Anthropic concluded by saying it encourages other AI developers to conduct similar audits and that evaluation exercises in general need stronger oversight and safeguards.
“Ultimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we’re approaching the fixes as if the responsibility were ours alone,” the post reads.
Industry peers characterized Anthropic’s revelations on the heels of OpenAI’s incident as a burgeoning pattern cyberdefenders should heed.
Tom Kellermann, the vice president of AI Security and Threat Research at TrendAI, said that these incidents underscore the continued need for safeguards even in secure sandbox environments.
“Anthropic and OpenAI just proved that when you strip guardrails for testing, you’re not creating a sandbox, you’re inviting systemic risk,” Kellermann said in a statement to Nextgov/FCW. “Every organization deploying agentic AI needs to ask itself if their evaluation environment is actually contained. Containment and monitoring are no longer optional.”