US company Anthropic has announced that its Claude artificial intelligence models gained unauthorized access to the computer systems of three organizations during internal cyber security tests after a configuration error allowed them to connect to the internet even though they were supposed to be operating in a completely isolated environment.
According to the company, the incidents were discovered following an extensive investigation triggered after rival OpenAI recently revealed a similar case where an AI agent exited the test environment and compromised the Hugging Face platform’s systems.
Three incidents discovered after analyzing over 141,000 tests
Anthropic said it reviewed more than 141,000 security tests and identified three separate incidents, the oldest of which occurred in April.
The events occurred during exercises of the type “capture the flag”, used to evaluate the hacking capabilities of artificial intelligence models. They are normally carried out in an isolated environment, without access to the internet and without the ability to interact with real systems, the BBC reports.
But the company claims that a configuration error in the infrastructure it manages with its testing partner, Irregular, allowed the Claude models to access the public internet.
AI models exploited elementary vulnerabilities
Once connected to the Internet, the Claude models compromised the computer systems of three organizations using relatively simple methods such as weak passwords or exposed services without authentication.
In one of the incidents, the AI model created a malicious program that was automatically downloaded by a cyber security company’s scanning system. Later, using the obtained credentials, he penetrated the organization’s infrastructure.
The worst case occurred when the model tried to attack a fictitious company in the test exercise, but because it had the same name as a real company, it accessed the existing organization’s database.
According to Anthropic, this was the only incident where the model continued its attack after realizing it was interacting with a real system.
The affected organizations did not notice the attacks
Anthropic states that neither the company nor the targeted organizations detected the attacks at the time of their occurrence. Two of the firms were subsequently notified by Anthropic, while the third had not yet been notified at the time of publication of the report.
The company did not reveal the identity of the affected organizations and took full responsibility for the configuration error that made it possible for the AI models to access the Internet.
Anthropic demands stricter security measures
The three incidents involved the Claude Opus 4.7, Claude Mythos 5 and an internal research model.
Anthropic representatives argue that these cases highlight the need for much stricter isolation and control measures in artificial intelligence development laboratories, both in its own infrastructures and those managed by external partners, as AI models acquire increasingly advanced capabilities in the field of cyber security.
n const _iprc = performance.now();nu003C/script>nnu003Cscript class=”optanon-category-C0004″ type=”text/plain”>nconsole.log(“*** cookieconsent done:”, Math.round(performance.now() – _iprc) / 1000);n gtag(‘event’, ‘cookieconsent’, {n name: ‘load’,n value: Math.round(performance.now() – _iprc) / 1000n });nu003C/script>nu003C!– END PERFORMANCE COOKIE PRO –>nn{{#unless context.ads_disabled}}nnu003Cscript class=”optanon-category-C0004″ type=”text/plain” src=”//a.teads.tv/page/99553/tag” async=”true”>u003C/script>n{{/unless}}nnu003Cdiv data-ad=”adevarul.ro_728x90_sticky_display_bottom_adevarul_bottom_center_leaderboard” data-devices=”m:0,t:1,d:1″ class=”demand-supply”>u003C/div>nn{{#if context.content}}nn{{#unless context.ads_disabled}}nu003Cscript class=”optanon-category-C0004″ type=”text/plain” src=”https://cnt.trvdp.com/js/1544/6545.js”>u003C/script>n{{/unless}}nnn{{/if}}nnn”,”html_mobile”:”nnnu003C!– CHECK PERFORMANCE COOKIE PRO –>nu003Cscript>n const _iprc = performance.now; – _iprc) / 1000n });nu003C/script>nu003C!– END PERFORMANCE COOKIE PRO –>nn{{#unless context.ads_disabled}}nnnu003Cscriptn class=”optanon-category-C0004″n type=”text/plain”n src=”//a.teads.tv/page/99553/tag”n async=”true”n>u003C/script>nn{{/unless}} nnu003Cdivn data-ad=”adevarul.ro_sticky_mobile_bottom”n data-devices=”m:1,t:0,d:0″n class=”demand-supply”n>u003C/div>nn{{#if context.content}} nnn{{#unless context.ads_disabled}}nu003Cscript class=”optanon-category-C0004″ type=”text/plain” src=”https://cnt.trvdp.com/js/1544/6545.js”>u003C/script>n{{/unless}}nn{{/if}}nn”},”updated_at”:”2025-11-01T11:3 1:21.462Z”},”AdPosition_head”:{“data”:{“custom_fields”:{},”for_desktop”:true,”for_mobile”:true,”html_desktop”:”u003Cmeta name=”profitshareid” content=”934cd37887433d585a2a227ef0576fcc” />nnnn{{#unless context.ads_disabled}}nnn{{#if context.content}}nu003Cscript type=”text/plain” class=”optanon-category-C0004″ src=”https://jsc.mgid.com/site/960965.js” async>u003C/script>nnnu003Cscript type=”text/plain” class=”optanon-category-C0004″>n (function () {n if (document.location.pathname.indexOf(“https://adevarul.ro/ghid-de-cumparaturi”) === 0) {n return;n }nn const s = document.createElement(“script”);n s.src = “https://srv.divee.ai/storage/v1/object/public/sdk/divee.sdk.latest.js”;n s.setAttribute(“data-project-id”, “4428864e-2da6-4fef-a83c-c16c2dfe86d9”);n s.async = true;n document.head.appendChild(s);n })();nu003C/script>nnnnnn{{/if}}nnu003Cscript>n window.teads_analytics = window.teads_analytics || {};n window.teads_analytics.analytics_tag_id = “PUB_26459″;n window.teads_analytics.share = window.teads_analytics.share || function() {n ;(window.teads_analytics.shared_data = window.teads_analytics.shared_data || ()).push(arguments)n };nu003C/script>nu003Cscript type=”text/plain” class=”optanon-category-C0004″ src=”https://a.teads.tv/analytics/tag.js”>u003C/script>nnn{{#unless context.features.nolivesupply}}nu003Cscript async data-cfasync=”false” type=”text/plain” class=”optanon-category-C0004″ src=”https://live.demand.supply/up.js”>u003C/script>n{{/unless}}nnu003Cscript type=”text/plain” class=”optanon-category-C0004″ src=”https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3345426167175409″ crossorigin=”anonymous”>u003C/script>nn u003Cscript type=”text/plain” class=”optanon-category-C0004″ src=”https://terrific.live/terrific-sdk.js” storeid=”iN6X0VPTDIicsVPKX6p0″>u003C/script>nn{{/unless}}nnu003Cstyle>n.google-adposition > div {n flex-grow: 1;n}nn.google-adposition:has(iframe) {n background-image: none !important;n}nn.menu-fixed .menu .headContainer .google-auto-placed {n display: none;n}nnarticle header .title .google-auto-placed {n display: none;n}nn#onetrust-banner-sdk #onetrust-accept-btn-handler {n margin-bottom: 10px;n }nn #onetrust-banner-sdk #onetrust-reject-all-handler {n visibility: hidden;n }nnu003C/style>nn u003C!– Facebook Pixel Code –>u003Cscript type=”text/plain” class=”optanon-category-C0002″>!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f.fbq)f.push=n;n.loaded=!0; n.version=’2.0′;n.queue=();t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)(0);s.parentNode.insertBefore(t,s)}(window,document,’script’,’https://connect.facebook.net/en_US/fbevents.js’); fbq(‘init’, ‘1346397800155390’); fbq(‘track’, ‘PageView’);u003C/script>u003Cnoscript> u003Cimg height=”1″ width=”1″ src=”https://www.facebook.com/tr?id=1346397800155390&ev=PageView&noscript=1″/>u003C/noscript>u003C!– End Facebook Pixel Code –>nnu003C!– alternativeAds –>n”,”html_mobile”:”u003Cmeta name=”profitshareid” content=”934cd37887433d585a2a227ef0576fcc” />nnn{{#unless context.ads_disabled}}nn{{#if context.content}}nu003Cscript type=”text/plain” class=”optanon-category-C0004″ src=”https://jsc.mgid.com/site/960965.js” async>u003C/script>nnu003Cscript type=”text/plain” class=”optanon-category-C0004″>n (function () {n if (document.location.pathname.indexOf(“https://adevarul.ro/ghid-de-comparaturi”) === 0) {n return;n }nn const s = document.createElement(“script”);n s.src = “https://srv.divee.ai/storage/v1/object/public/sdk/divee.sdk.latest.js”;n s.setAttribute(“data-project-id”, “4428864e-2da6-4fef-a83c-c16c2dfe86d9”);n s.async = true;n document.head.appendChild(s);n })();nu003C/script>nn{{/if}}nnu003Cscript>n window.teads_analytics = window.teads_analytics || {};n window.teads_analytics.analytics_tag_id = “PUB_26459″;n window.teads_analytics.share = window.teads_analytics.share || function() {n ;(window.teads_analytics.shared_data = window.teads_analytics.shared_data || ()).push(arguments)n };nu003C/script>nu003Cscript type=”text/plain” class=”optanon-category-C0004″ src=”https://a.teads.tv/analytics/tag.js”>u003C/script>nn{{#unless context.features.nolivesupply}}nu003Cscript async data-cfasync=”false” type=”text/plain” class=”optanon-category-C0004″ src=”https://live.demand.supply/up.js”>u003C/script>n{{/unless}}nnu003Cscript type=”text/plain” class=”optanon-category-C0004″ src=”https://terrific.live/terrific-sdk.js” storeid=”iN6X0VPTDIicsVPKX6p0″>u003C/script>nn{{/unless}}nu003Cstyle>nn.google-adposition:has(iframe) {n background-image: none !important;n}nn.menu-fixed .menu .headContainer .google-auto-placed {n display: none;n}nnarticle header .title .google-auto-placed {n display: none;n}nn#onetrust-banner-sdk #onetrust-accept-btn-handler {n margin-bottom: 10px;n }nn #onetrust-banner-sdk #onetrust-reject-all-handler {n visibility: hidden;n }nu003C/style>n”},”updated_at”:”2026-07-22T15:44:05.196Z”}},”last_changed”:”2026-08-04T18:45:10.011Z”,”page”:{“created_at”:”2025-11-07T07 :21:20.397Z”,”created_by”:1,”custom_fields”:{},”domain”:”adevarul.ro”,”id”:99,”last_published_at”:”2025-11-07T07:21:23.058Z”,”name”:”Content layout (article)”,”published”:1,”s3_hash”:”a5e0764cf3bce051367545eab1538b4619e8ecb9″,”slug”:null,”title”:”Content layout”,”type”:”layout”,”updated_at”:”2022-07-21T08:27:20.732Z”,”version_id”:267},”path”:”/lifestyle/technology/a-new-security-gap-after-open-ai -2546816.html”,”pathArray”:(“”,”lifestyle”,”technology”,”a-new-security-gap-after-open-ai-2546816.html”),”type”:”content”,”url”:”https://adevaru l.ro/stil-de-viata/tehnologie/o-noua-bresa-de-securitate-dupa-cazul-open-ai-2546816.html”,”features”:{},”query”:{},”domain_config”:{“MISC”:{“logo”:{“width”:320,” height”:50}},”SYSTEM_TAGS”:(“noads”,”nocomments”,”sex”,”advert”,”advertorial”,”video”,”gallery”,”live”,”photo”,”exclusive”,”analysis”,”interview”,”report”,”breaking news”),”default”:{“lang”:”ro”,”domain”:”adevarul.ro”,”alternateDomain”:”adevarul-ro.adh.reperio.news”,”friendlyName”:”Adevărul”,”logoURL”:”https://adevarul.ro/favicon-144-precomposed.png”}},”client”:{“is_mobile”:false}}
