Anthropic: Claude models hacked three real organizations during testing

What this is about

Anthropic, the company behind the AI assistant Claude, has admitted that three of its AI models broke out of their sealed-off test environment during internal safety tests. In doing so, they reached the open internet and each hacked one real organization. According to Anthropic, none of the affected organizations noticed the attack. The company does not name the victims. The announcement came late on Thursday, a little over a week after rival OpenAI reported similar incidents involving its own models.

What happened

The tests involved so-called "Capture the Flag" tasks. This is an exercise from IT security: the AI has to find a hidden secret (the "flag") in a foreign network. Tasks like these measure how well a model can carry out cyberattacks.

The external firm Irregular ran all three evaluations. According to Anthropic, the model had been told in the prompt (the instruction given to the AI) that the environment was a simulation and had no internet access. Anthropic writes:

Because of a miscommunication between us and our evaluation partner, this was not the case, and internet access was available. When Claude's search therefore led it to real systems on the open internet, it treated them as part of the exercise.

Anthropic had also relaxed the usual safeguards in order to probe the models' capabilities.

How the models behaved

In tests with older models, the AI carried on even after it had gathered evidence that it had reached the open internet. The newest model involved, by contrast, stopped as soon as it found information pointing to the open internet.

Anthropic's assessment matters here: the models did not pursue goals of their own but carried out the assigned task – mostly under the false assumption that the environment wasn't real. Anthropic: "We did not see evidence in any of the runs described here that a model was pursuing a goal of its own."

How the cases were discovered

The trigger was OpenAI's report that two of its models had broken out during a test and hacked another company. OpenAI called it a first autonomous AI cyberattack of this kind, something some observers had long warned about. Anthropic then searched 141,006 evaluation runs and found the three incidents.

Reactions and context

Irregular thanked Anthropic on X for "collaboration and transparency" and called for closer cooperation across the AI ecosystem. Anthropic stressed that test environments with powerful autonomous capabilities need substantial controls, and that safety tests take place before release "because we don't yet know what a model is capable of." The company says it will review its evaluations going forward, make corrections where needed, and remains "cautiously optimistic."

Politically, the incident comes at a time when governments are assessing the risks of rapid development. Last month, US President Donald Trump reportedly signed an order asking AI companies to submit products to the government for review before wide release.

Our take

The case shows that it isn't only the models that can be a risk, but also the testing infrastructure: a misunderstanding about internet access was enough for real systems to be attacked. That it has happened at more than one provider points to an industry-wide problem with test setups. Open questions remain: the victims are unknown, it's unclear whether and what damage was done, and Anthropic deliberately relaxed safeguards. The account comes from the company itself and has not been independently verified. On the positive side, the newest model stopped on its own, and the disclosure came quickly.