{"id":4762,"date":"2026-07-31T16:12:34","date_gmt":"2026-07-31T16:12:34","guid":{"rendered":"https:\/\/silvybrand.com\/?p=4762"},"modified":"2026-07-31T16:12:34","modified_gmt":"2026-07-31T16:12:34","slug":"anthropic-claude-hacked-organizations-during-cyber-tests","status":"publish","type":"post","link":"https:\/\/silvybrand.com\/?p=4762","title":{"rendered":"Anthropic says Claude accidentally hacked real companies too"},"content":{"rendered":"


\n<\/p>\n

\n
\n

Anthropic just realized<\/a> several of its Claude AI models hacked into the systems of three different organizations during testing, acting on their own and without the company noticing. The revelation comes days after rival OpenAI said one of its own models had breached developer platform Hugging Face, adding to growing unease<\/a> over whether frontier AI labs are doing enough to control the increasingly capable systems they are building.<\/p>\n<\/div>\n

\n

In a blog post<\/a> describing the incidents, Anthropic said Claude gained unauthorized access to the systems during cybersecurity evaluations. All of the attacks happened during \u201ccapture-the-flag\u201d exercises, a common way of testing hacking ability, where models are asked to find and obtain hidden information inside of a simulated network.<\/p>\n<\/div>\n

\n

The disclosure adds to mounting pressure on frontier AI labs in the wake of the Hugging Face incident and the release of powerful open-weight Chinese models. Employees at the major labs are now calling<\/a> for coordinated global governance, and US lawmakers have begun weighing<\/a> tighter oversight of powerful models and who can access them<\/a>.<\/p>\n<\/div>\n

\n

Anthropic says the environment for its cybersecurity tests was supposed to be isolated. However, a \u201cmisconfiguration\u201d left the machines Claude accessed \u201cwith live internet access,\u201d the company said, and because all models had been \u201cexplicitly told\u201d they had no internet access, they \u201cassumed\u201d the real networks it encountered were part of the simulated environment.<\/p>\n<\/div>\n

\n

The earliest incidents date back to April and involved three different Claude models: Opus 4.7, Mythos 5<\/a>, and \u201can internal research test model,\u201d according to the blog post. As the models were being tested on their cyber abilities, Anthropic said they lacked the standard safeguards usually put in place to curtail riskier behavior.<\/p>\n<\/div>\n

\n

The company said it discovered incidents after reviewing more than 141,000 cybersecurity test runs, something it only did after OpenAI disclosed<\/a> its rogue AI agent was behind the attack on Hugging Face.<\/p>\n<\/div>\n

\n

The three models behaved very differently when they encountered information suggesting that the systems they were encountering were, in fact, real. By Anthropic\u2019s account, the oldest model, Opus 4.7, recognized it had reached a real system, \u201cbut continued its attack.\u201d Its flagship Mythos 5 figured out it was using the internet but somehow reasoned this was all still part of the simulation, so continued. The internal test model, which Anthropic describes as \u201cour latest model,\u201d stopped the exercise when evidence emerged that its targets were real.<\/p>\n<\/div>\n

\n

Anthropic did not identify the affected organizations and said it will continue to investigate the incident and provide updates when it can. The company said it is also speaking with AI research nonprofit METR about conducting a third-party review of what happened. OpenAI has also hired METR to conduct an independent review.<\/p>\n<\/div>\n

\n

Throughout the post, Anthropic repeatedly contrasts both the nature and its handling of the incidents with OpenAI\u2019s, ending with a bulleted, four-point list outlining the differences \u2014 and why it believes its own response was better. Anthropic emphasizes that it \u201cproactively\u201d reviewed its tests, and did so before a company detected any activity. It also said its models accessed the internet \u201cvia an open path,\u201d rather than using a novel exploit like OpenAI\u2019s agent, adding that its most recent model also stopped when it realized it was working in a real environment.<\/p>\n<\/div>\n

\n

Anthropic also said its models failed in a different way from OpenAI\u2019s agent, indicating that this was a safer form of failure. \u201cWhile there is not a perfectly sharp distinction between the two, we believe these incidents to be closer to a harness and operational failure than a model alignment failure,\u201d the company said. In plain English: The Claude models were doing what they were told, while OpenAI\u2019s agent pursued its goal in a way its creators did not intend, described as misalignment in the AI safety world.<\/p>\n<\/div>\n

\n

Anthropic called on other AI labs to conduct similar proactive reviews of its cyber testing, adding that the discovery underscores the need for stronger controls and safety measures when testing AI systems.<\/p>\n<\/div>\n

Follow topics and authors<\/strong> from this story to see more like this in your personalized homepage feed and to receive email updates.<\/span><\/p>\n