- Anthropic says its Claude AI models accessed the systems of three real organisations during security testing.
- The company says the incidents were caused by a testing misconfiguration rather than intentional AI behaviour.
- The disclosure follows a similar incident involving OpenAI, raising fresh concerns about AI safety.
The debate around AI safety has taken another turn after Anthropic revealed that some of its Claude AI models accidentally gained access to the systems of three real organisations during cybersecurity testing.
The company said the incidents happened because a testing environment that was supposed to be isolated from the internet had been incorrectly configured. Instead of remaining inside a closed simulation, the AI models connected to live systems, believing they were still carrying out the tasks they had been assigned.
The disclosure comes just days after OpenAI reported that one of its own experimental AI agents breached the systems of AI platform Hugging Face during a separate security evaluation, prompting wider questions about how advanced AI models are being tested.
How did the AI end up attacking real systems?
Anthropic said it reviewed more than 141,000 cybersecurity evaluation runs after learning about OpenAI's incident. During that review, it discovered three cases dating back to April in which Claude had unintentionally accessed real organisations.
The AI models were taking part in so-called "capture-the-flag" exercises, a common cybersecurity test in which systems are instructed to locate hidden information by attempting to break into simulated computers.
Claude had been told it was operating inside a closed environment without internet access. However, because of a configuration error involving systems managed by Anthropic and one of its testing partners, the models were able to reach the public internet.
According to Anthropic, the models believed the real websites and servers they encountered were still part of the exercise.
The company said there was no evidence that Claude tried to escape deliberately or acted with its own objectives. Instead, it continued following the instructions it had been given.
The review found that one model compromised a real company's infrastructure using weak passwords and publicly exposed services. Another uploaded a malicious Python package to the public PyPI software repository before it was removed about an hour later. A third research model stopped its activity after recognising that it had reached a real organisation.
Anthropic said the affected models were running without the additional safeguards normally included in public versions of Claude.
Why the industry is paying attention
Anthropic has paused its cybersecurity evaluations, informed the affected organisations and begun investigating the incidents alongside independent AI evaluator METR. The company has also called on other AI developers to review their own testing environments for similar weaknesses.
The incidents have added to growing concerns about increasingly capable AI agents, which can perform tasks with minimal human involvement. Experts argue the latest disclosures highlight weaknesses in testing systems rather than evidence that AI is independently trying to attack organisations.
Professor Gina Neff of the University of Cambridge reportedly said the models were simply doing what they had been instructed to do, adding that the focus should be on the companies responsible for ensuring safe testing and appropriate oversight.
David Allott of Veeam Software reportedly said the incidents demonstrate how AI agents can combine existing capabilities, obtain credentials and operate autonomously at machine speed, rather than revealing an entirely new hacking technique.
The back-to-back disclosures from OpenAI and Anthropic have intensified calls for stronger safeguards, better monitoring and stricter industry standards as AI systems become more autonomous. With billions of pounds being invested in AI agents capable of carrying out increasingly complex tasks, the question is shifting from whether these models are becoming more capable to whether the environments used to test them are keeping pace.
