Anthropic uncovered the incidents after reviewing more than 141,000 cybersecurity evaluation runs launched in response to the OpenAI disclosure.
In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different…
The firm had tasked Claude with a “capture-the-flag challenge,” in all three incidents, Anthropic wrote. The challenge tasks the model with breaking into a different machine on the network and retrieving a piece of secret information. “The challenge is left open-ended, and no particular method is prescribed,” Anthropic explained.
The firm said Claude had been told it was operating in a simulated environment without internet access. However, the test environment remained connected to the public internet. Believing the systems it encountered were part of the exercise, the model used common attack techniques—including weak passwords, exposed credentials, SQL injection, and unauthenticated endpoints—to compromise the companies.
AI want to break freeThis latest disclosure comes as frontier models show increasing ability to outsmart their containment protocols.
Two of the affected organizations were unaware of the intrusions until Anthropic notified them.
“In each of these cases, Claude was explicitly told by our prompt that it had no internet access,” Anthropic wrote, with the AI assuming real-world systems were “parts of the exercise.” Because a capture-the-flag scenario is “by design an instruction to attack an external system,” breaking in was “in line with the task Claude had been given.”
Anthropic said it found no evidence that Claude tried to escape its test environment or do anything beyond the task it had been assigned, and that the incidents were caused by failures in the testing environment, not by problems with the model itself.
Anthropic said it stopped its cybersecurity tests after discovering the issue, notified the affected organizations, and plans to improve monitoring, investigation tools, and oversight of the outside vendors that help run its AI tests.
“Ultimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we’re approaching the fixes as if the responsibility were ours alone,” they said.
