Anthropic has disclosed that three of its Claude AI models gained unauthorized access to the live systems of three organizations during internal cybersecurity evaluations after a testing environment was mistakenly left connected to the internet.
The company said it uncovered the incidents during an internal review prompted by OpenAI's recent disclosure that one of its unreleased AI models breached Hugging Face's systems during testing.
Anthropic reviewed 141,006 evaluation runs and identified three incidents in which Claude models accessed the internet while participating in cybersecurity exercises with partner Irregular. The company attributed the incidents to a misconfiguration in the evaluation environment and a misunderstanding over whether internet connectivity had been disabled.
According to Anthropic, the models were explicitly instructed that they had no internet access, but they interpreted real-world systems as part of the simulated testing environment.
Three models behaved differently
The incidents involved Claude Opus 4.7, Mythos 5, and an unnamed internal research model.
Anthropic said Claude Opus 4.7 recognised it had reached real production systems but continued executing its assigned task, including retrieving credentials and interacting with a production database.
Mythos 5 also detected signs it was operating on the real internet but concluded it was still inside a simulation. During the evaluation, it published a malicious software package to the public PyPI repository, where it was downloaded and executed before being identified and removed.
The company's latest internal research model took a different approach, halting its activity after determining the target systems were real rather than simulated.
No evidence of autonomous intent
Anthropic said its investigation found no evidence that any of the models pursued independent goals or attempted to escape their testing environment.
Instead, the company said the models continued carrying out the objectives defined in their prompts because they mistakenly believed the real systems were part of the authorised evaluation.
The company added that the tests were conducted without the additional safety monitoring systems and classifiers used in publicly deployed Claude models, as the evaluations were intended to measure the models' underlying cybersecurity capabilities.
Third-party review underway
Anthropic distinguished the incidents from OpenAI's recently disclosed security breach, saying its models reached live systems through a mistakenly open internet connection rather than by exploiting an unknown software vulnerability to escape a sandbox.
The company said it detected the incidents through its own proactive investigation and that the affected organisations had not identified the activity themselves.
Anthropic is now working with independent AI evaluation organisation METR to conduct a third-party review of the incidents and plans to strengthen safeguards for future cybersecurity testing involving advanced AI systems.
