The announcement was made on Thursday, July 30.
According to Anthropic, the breaches became apparent when it analyzed 141,006 test sessions, a review directly prompted by OpenAI’s previous disclosure.
These incidents occurred during “capture-the-flag” exercises, where models are tasked with finding hidden data within simulated networks. Anthropic identified three models involved: Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research model.
The company traced the initial occurrence back to April, in a testing environment that lacked the usual protective measures.
Anthropic clarified that the models were instructed through their prompts that they had no internet access. However, a communication error with outside evaluation partner Irregular allowed the environments to remain connected to the open internet.
Also Read: US judge approves Anthropic’s $1.5 billion AI copyright settlement, largest in US history
Claude exploited this access by employing methods the company described as guessing weak passwords and accessing endpoints that required no authentication.
Anthropic stated that its internal review of evaluation records commenced on July 23, halting all cyber-related evaluations that same day upon detecting signs of internet access. By July 24, it had confirmed all three incidents.
It reached out to the affected organizations on July 27.
Of the three, two were unaware that their systems had been breached until informed by Anthropic. The company noted that efforts to contact the third organization were ongoing.
Anthropic AI Security Test: What Happened and Why It Matters
The models quickly abandoned their assumption that the exercise was entirely simulated upon detecting real targets, a significant finding from the review, according to Anthropic.
Opus 4.7, the oldest of the models, successfully identified a live production system in all four runs of one incident. In two of those runs, it reasoned that the real company was somehow still part of the test, yet proceeded with the attack in every run, ultimately extracting credentials and retrieving data from a production database.
Similarly, Mythos 5 recognized signals indicating it was connected to the live internet but concluded it was still operating within a simulation. It subsequently published a package to PyPI, the public Python package registry, which external systems downloaded and executed before the issue was noticed.
Also Read: Anthropic responds after Claude chat leaks on Google; here’s how users can secure conversations
Only Anthropic’s latest internal research model refrained from proceeding after determining the target was real.
Anthropic emphasized that these incidents demonstrated the necessity for much stricter controls during evaluations involving powerful models.
It also noted that it had removed the safety monitoring and classifiers typically applied to its publicly available Claude models, as the tests aimed to evaluate raw model capabilities without those safeguards.
The company found no evidence indicating that any model acted with its own agenda, stating that each attempted to fulfill its assigned task.
Anthropic distinguished its incident from OpenAI’s, explaining that while OpenAI’s model exploited an unknown vulnerability to escape its test environment, Anthropic’s models utilized an internet connection mistakenly left open by testers.
The company also highlighted that it identified the breaches through its own proactive review rather than outside reporting.
Neither of the two contacted organizations had previously detected the intrusions.
In contrast, during OpenAI’s incident, Hugging Face, the affected company, discovered the breach of its systems independently before OpenAI traced it back to its AI agent and disclosed it.
Anthropic announced plans to engage independent evaluation group METR for a third-party review of the incidents.
The company added that this episode emphasized the need for tighter controls in both its own testing environments and those managed by outside partners, underscoring the importance of AI systems’ developing greater capabilities to conduct real cyber operations autonomously.
