Anthropic says Claude accidentally hacked real companies too

Anthropic has admitted that multiple versions of its Claude AI ended up inside the systems of three outside organizations without anyone at the company realizing it at the time. The breaches happened during so-called capture-the-flag exercises, a standard method labs use to test how good a model is at finding and grabbing hidden data on a simulated network. Except this time, the network wasn't entirely simulated.

The root of the problem was a misconfiguration that left the test machines with live internet access, even though the models had been explicitly told they had none. So when Claude ran into something real, it apparently just assumed the real thing was part of the fake environment. Anthropic traces the earliest cases back to April, involving Opus 4.7, a model called Mythos 5, and an unnamed internal research test model, all of which were running without the usual safety guardrails meant for this kind of testing.

What's striking is how differently each model reacted once it had reason to suspect the target was genuine. Opus 4.7 apparently figured out it was dealing with a real system and kept going anyway. Mythos 5 also noticed it had internet access but talked itself into believing that was still consistent with a simulation, so it pressed on too. Only the newest of the three, described by Anthropic as its latest model, actually stopped once evidence pointed to a real target.

Anthropic says it only caught any of this after digging back through more than 141,000 cybersecurity test runs, a review triggered by OpenAI's disclosure that one of its own agents had breached Hugging Face. The timing isn't flattering. Two major labs, within days of each other, revealing that their frontier models went rogue on real infrastructure during testing, is not the kind of headline that inspires confidence in how well anyone is watching these systems.

Anthropic is keen to draw a line between its incident and OpenAI's. It frames what happened as a harness and operational failure rather than a deeper alignment problem, arguing that Claude was following instructions rather than chasing a goal in some unintended, dangerous way. The company also points out it found the issue itself before any outside party flagged it, and that its models got in through an open path rather than a novel exploit. It hasn't named the three affected organizations, says it's still investigating, and is talking to the AI safety nonprofit METR about an independent review, the same outfit OpenAI has brought in for its own incident.