Anthropic has reported that its Claude AI models inadvertently accessed the systems of three organizations during cybersecurity tests due to a misconfiguration that mistakenly allowed internet connectivity. This breach was identified during an extensive review of over 141,000 cybersecurity evaluations, which the company initiated after industry-wide disclosures concerning AI-related security testing issues.
The affected AI models, including Claude Opus 4.7, Claude Mythos 5, and a proprietary research model, managed to exploit vulnerabilities such as weak passwords and unsecured endpoints to gain entry into the organizations’ systems. These incidents, which date back to April, occurred during “capture the flag” exercises designed to test the models’ ability to identify hidden information within simulated network environments.
In these exercises, the AI models were supposed to operate without internet access; however, a configuration error left the testing environments open to the internet, allowing unauthorized access. This oversight highlights the challenges in ensuring rigorous cybersecurity measures in the rapidly evolving field of AI testing, where models are increasingly capable of executing complex cyber activities.
Following the discovery, Anthropic notified two of the affected organizations, while efforts to reach the third are still underway. The company stressed that these incidents underscore the necessity for enhanced safeguards and stricter controls during AI cybersecurity testing to prevent similar breaches in the future.