Anthropic Finds 3 Claude AI Security Incidents After Reviewing 141,006 Cybersecurity Test Runs, Including Access to 3 Real Organizations and 15 Systems Affected

Anthropic has disclosed that three of its Claude AI models unintentionally accessed and compromised the production infrastructure of three separate organizations during internal cybersecurity evaluations, following a configuration error that left testing environments connected to the public internet. The company said the incidents occurred during capture-the-flag (CTF) security exercises and were discovered during a retrospective review initiated after OpenAI reported a similar AI security incident.

According to Anthropic, a review of 141,006 cybersecurity evaluation runs identified three separate incidents involving six evaluation runs. In each case, Claude was instructed that it was operating in a simulated environment with no internet access. However, due to a misunderstanding between Anthropic and its third-party evaluation partner, Irregular, the evaluation environments retained live internet connectivity, allowing the AI models to interact with real-world systems.

The company said the models interpreted the external systems as part of the simulated exercise and attempted to complete their assigned objectives using common cybersecurity techniques, including exploiting weak passwords, unauthenticated endpoints, exposed debug pages and SQL injection. Anthropic stated that none of the models exploited sophisticated zero-day vulnerabilities or attempted to escape the testing environment deliberately.

The incidents involved three different models: Claude Opus 4.7, Claude Mythos 5 and an internal research test model. Anthropic noted that these evaluations were conducted without the monitoring systems and misuse detection safeguards normally included in publicly available Claude deployments, although the models retained their safety training.

The most significant incident involved Claude Opus 4.7, which mistakenly identified a real company as its fictional target after both shared the same name. Across four evaluation runs, the model extracted application credentials, infrastructure credentials and gained access to a production database containing several hundred rows of real data. Anthropic acknowledged this represented the most serious impact among the three incidents.

A second incident involved Claude Mythos 5 publishing a malicious Python package to the public Python Package Index (PyPI). Believing the repository was part of the simulated evaluation, the AI uploaded malware intended to complete the capture-the-flag challenge. The package remained publicly available for approximately one hour before PyPI’s automated security systems removed it.

During that period, the package was downloaded and executed on 15 real systems, including an automated malware-scanning platform operated by a cybersecurity company. Anthropic said the AI subsequently used credentials collected from that system to access additional infrastructure belonging to the company, although it had not intentionally targeted the organization.

The third incident involved an internal research model scanning approximately 9,000 internet-connected systems after failing to locate its fictional target. The model eventually compromised one company’s internet-facing application using publicly known attack techniques. Anthropic said the model later recognised the system was real and voluntarily stopped the attack without completing further actions.

Anthropic said it suspended all cybersecurity evaluations on July 23 after identifying evidence of possible internet access. The three affected organizations and evaluation partner Irregular were notified on July 27. The company stated that two organizations had not previously detected the activity and remediation efforts are underway, while contact attempts continue with the third organization.

The AI developer said it is strengthening evaluation security by improving containment of testing environments, expanding continuous monitoring, enhancing investigation tools and implementing stricter oversight of third-party evaluation infrastructure. Anthropic also plans to release a redacted transcript of one incident involving the malicious PyPI package while working with independent AI evaluation organization METR for a third-party review.

The company emphasised that the incidents resulted from evaluation environment misconfigurations rather than deliberate autonomous behaviour by the AI models. Anthropic added that newer models demonstrated improved situational awareness, with its latest research model halting its actions after recognising it had reached real-world systems.