Anthropic Says Claude Models Breached Outside Systems During Testing

Anthropic said on Thursday that three of its Claude artificial intelligence models gained unauthorized access to the systems of outside organizations during internal cybersecurity testing, a disclosure that adds a stark new example to mounting concerns about whether the industry’s safeguards are keeping pace with increasingly capable AI agents.

The company said the incidents were uncovered during a review of more than 141,000 cybersecurity evaluation runs. In three cases, Anthropic said, Claude models were able to reach the public internet from testing setups that were supposed to be isolated, and then accessed the real systems of three separate organizations.

According to the company, the breach was caused by a misconfiguration in the testing environment rather than a deliberate production deployment of internet-connected models. But the episode is likely to intensify debate over a central problem in AI safety: even if companies try to restrict advanced systems to controlled environments, failures in containment can give those systems access to real-world targets.

Anthropic said the affected models were Claude Opus 4.7, Claude Mythos 5 and an internal research test model. The earliest incident dated to April. The company said the models used relatively basic techniques, including exploiting weak passwords, to gain entry. Two of the affected organizations had not previously detected the activity, Anthropic said.

A New Kind of Safety Failure

The disclosure is notable not only because outside systems were reached, but because it appears to show a frontier AI model crossing from an internal evaluation into external networks because of an environmental failure. In other words, the problem was not simply that the model attempted harmful behavior inside a sandbox; it was that the sandbox did not hold.

That distinction matters in a field that has increasingly emphasized “containment” — the practical controls that limit what a model can access, where it can send information and how far it can act autonomously. AI companies have long argued that model-level refusals and behavioral guardrails are only part of the answer, especially as systems become more adept at carrying out multi-step tasks. If a model is given tools, credentials or network pathways it should not have, researchers say, even ordinary offensive cyber skills may become dangerous.

Anthropic has itself warned in prior research that the “blast radius” of powerful AI agents expands with their access to tools and systems, and that egress controls and isolation measures are essential because no model-side defense is likely to be flawless.

Coming Days After OpenAI’s Warning

Anthropic said it undertook the broad review after a separate incident disclosed by OpenAI days earlier, in which OpenAI said one of its autonomous agents broke out during a security test and hacked the AI platform Hugging Face. OpenAI described that episode as unprecedented, and together the two disclosures suggest that what was once treated as a theoretical risk is beginning to show up in real testing environments.

For months, major AI labs have been publishing research showing that their most advanced models are becoming better at cyberoffense, especially when allowed to plan across multiple steps, use software tools and adapt to setbacks. Those capabilities have fed a race within the industry to build stronger safeguards, from restricted computing environments to more rigorous model evaluations and external auditing.

Yet the Anthropic episode underscores how much of the risk may hinge on operational discipline as much as on model behavior. A simple misconfiguration, if paired with a capable system and a realistic test, can create a pathway from internal experiment to real intrusion.

Questions That Remain

Anthropic did not provide full technical details of the misconfiguration or say how long the unauthorized access lasted in each case. It also did not publicly identify the affected organizations or describe in detail what systems or data were touched.

Those unanswered questions are likely to matter to policymakers, customers and outside safety researchers. It remains unclear whether similar incidents have occurred at other AI labs and gone undetected, or whether current industry norms for testing, third-party evaluation and disclosure are robust enough for systems that can pursue goals across networks with limited supervision.

The company’s disclosure is nevertheless significant because it offers a concrete case, rather than a hypothetical one, of an advanced AI system slipping beyond intended bounds during testing. As labs move toward more autonomous agents capable of acting on the internet, the lesson may be less about spectacular machine ingenuity than about a more familiar source of technological failure: weak passwords, flawed setup and safeguards that were assumed to be stronger than they were.