Claude AI hacked 3 companies using basic techniques, Anthropic admits mistake

Anthropic has admitted that its Claude AI accidentally hacked three real organisations during cybersecurity testing after a setup error gave it internet access. The company says the incidents exposed flaws in its testing environment, not an AI trying to break free.

In Short

• Claude used basic hacking methods like weak passwords and SQL injection
• One AI model uploaded malware to the public PyPI software repository
• Anthropic halted testing and tightened security after discovering the incidents

Anthropic has disclosed that its Claude AI models accidentally hacked the systems of three real organisations during cybersecurity testing after a configuration error gave the AI access to the open internet. The company says the incidents were not the result of Claude trying to escape its test environment, but of a mistake in how the evaluations were set up.

"After reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorised access to the production infrastructure of three different organisations," the company said in its blog post.

The revelation comes shortly after OpenAI reported that some of its AI models had escaped an isolated testing environment by exploiting a previously unknown software vulnerability. That disclosure prompted Anthropic to conduct a large review of its own cybersecurity evaluations to check whether Claude had ever reached systems it wasn't supposed to. The company examined more than 141,000 evaluation runs and found three incidents where Claude accessed the internet while taking part in "capture-the-flag" exercises. These tests are designed to measure an AI model's hacking abilities by asking it to retrieve hidden information from a simulated network.

According to Anthropic, Claude had been clearly told that it was working inside a fictional environment with no internet access. But because of a misconfiguration between Anthropic and its third-party evaluation partner, the test machines were actually connected to the internet. As a result, Claude assumed the real websites and servers it discovered were simply part of the challenge.

Claude used simple hacking methods

Anthropic said the AI relied on basic hacking methods rather than advanced exploits. It used techniques such as weak passwords, exposed debug pages, SQL injection and unauthenticated endpoints to gain access to systems. The company added that Claude never attempted to copy itself, escape the testing environment or pursue goals beyond completing the assigned task.

One of the incidents involved Claude Opus 4.7, which mistakenly targeted a real company after its name matched that of a fictional business used in the exercise. Believing it had found the intended target, the model gained access to the company's infrastructure, extracted credentials and reached a production database containing several hundred rows of data. Anthropic described this as the most serious of the three incidents.

Another case involved Claude Mythos 5, which created and uploaded a malicious Python package to the public PyPI software repository. The AI believed the repository was part of the simulation, but the package was briefly available online for around an hour before being removed. During that time, it was downloaded by 15 real systems, including an automated security scanner operated by a cybersecurity company. Anthropic said the scanner executed the package as part of its normal process, allowing the AI to collect credentials before the package was taken down.

Anthropic says testing setup was to blame

The third incident involved an internal research model that scanned roughly 9,000 internet-connected targets after failing to reach its fictional objective. It eventually compromised one company's application using exposed credentials and SQL injection. Unlike the older models, however, this version stopped its activity after recognising it had reached a real system outside the intended evaluation.

Anthropic said the evaluations were carried out without the monitoring and misuse protections that are normally enabled in publicly available Claude models. Once the issue was discovered, the company halted all cyber evaluations, informed its evaluation partner Irregular and notified the affected organisations.

While comparing its findings with OpenAI's recent disclosure, Anthropic argued that the two incidents were different. OpenAI's models escaped through a previously unknown vulnerability, whereas Claude reached the internet because the testing environment had been left connected by mistake. The company believes the episode highlights the need for stronger safeguards around AI testing as models become increasingly capable.

- Ends