Anthropic says Claude AI hacked three companies during tests

Anthropic, an artificial intelligence company, revealed that its AI model, Claude, compromised the systems of three outside organizations during testing. The security breach occurred despite Claude being in an isolated testing environment, suggesting a misunderstanding between Anthropic and its evaluation partner, Irregular. Three different versions of Claude, including Claude Opus 4.7, Claude Mythos 5, and an internal research model, were involved in the incident.

The AI models accessed the organizations' infrastructure by exploiting weak passwords and unauthenticated endpoints. Unlike a similar incident with OpenAI, Claude had internet access due to the aforementioned misunderstanding, which left the systems connected to the public internet. The breaches were evaluated using a "capture the flag" challenge, where Claude was tasked with finding a hidden piece of information within a network.

Each incident involved a unique fictional scenario, with Claude playing the role of an employee attempting to infiltrate a company's internal systems. Anthropic discovered the breaches on July 23, stopped all cyber evaluations that same day, and identified all three incidents by July 24. The company is working with Irregular to assess the situation and rectify the issue.