AI firm Anthropic has discovered its ‘Claude’ AI models hacked into three organisations by mistake, just days after industry rival OpenAI announced its own models had autonomously compromised multiple platforms during testing.

The San Francisco-based company said the attacks occurred because Claude gained access to an internet connection it was not supposed to have access to.

During internal testing to measure the AIs’ cybersecurity capabilities, Anthropic’s models were tasked with a ‘capture-the-flag challenge’ where secret information was hidden on a different machine on a private network.

Instead of limiting itself to the test environment, the AI gained unauthorised access to the production infrastructure of three external organisations.

Anthropic did not announce or discover their AI hacks until after OpenAI attracted significant media attention by announcing its models had mistakenly hacked open-source AI company Hugging Face along with another unnamed platform.

“In response to [OpenAI’s] incident, we began a large-scale retrospective review of our own cybersecurity evaluations,” wrote Anthropic on Thursday.

After reviewing the logs of more than 141,000 evaluations, the company discovered the three cases where Claude mistakenly treated real systems as part of its cybersecurity tests.

The three attacks

Anthropic said all three AI-driven attacks were enabled, at least in part, by human error.

The first incident occurred because a real company's domain name matched that of a fictional target created by Anthropic's evaluation partner, leading Claude to attack the wrong organisation.

In the second test-gone-wrong, Claude was provided access to a document that instructed employees at a fictional company to install a Python package from public code registry PyPI.

To ‘trick’ these made-up employees into compromising their organisation, the model created a real-life email account, signed up to PyPi, and uploaded malware for them to mistakenly download.

Instead, the package was downloaded by 15 real systems and was installed by a cybersecurity company as part of a routine malware scan.

The malware then procured some of the real-world company’s credentials, enabling Claude to access part of its infrastructure.

The third incident occurred after a Claude model failed to reach its intended, fictional test target, and then sought alternative victims online.

Anthropic said this attack involved basic credential exposure and SQL injection techniques, and that its model eventually ceased its attack after determining the company was real.

The first two organisations were unaware of the activity until Anthropic notified them. The company said it has so far been unable to contact the third victim but is "continuing to reach out".

Proper safeguards would have blocked it

While OpenAI's recent incident involved a model finding its own route to the internet by exploiting another internal system, Anthropic said Claude's internet access stemmed from a simple configuration error.

Though Claude’s AI was told it was in a simulation with no internet access, a misunderstanding between Anthropic and its evaluation partner meant internet access was left available.

“Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise,” wrote Anthropic.

With a carte blanche pass to the internet and an open-ended directive to capture the ‘flag’, the models used basic techniques, such as exploiting weak passwords and unauthenticated endpoints, to compromise the three organisations.

Unlike OpenAI, no zero-day vulnerabilities were exploited during the accidental attacks.

‘We don’t yet know what it is capable of’

The incidents involved three different Claude models: Opus 4.7, the previously banned, cybersecurity-focused Mythos 5 model, and an unnamed internal research test model.

Anthropic said the incidents demonstrated that advanced AI agents can pose a "substantial threat" even when they do not have access to sensitive information.

“We need to better co-design evaluation environments, and do better monitoring of evaluation results, to meet this threat,” wrote Anthropic.

“Safety testing happens before a model is released precisely because we don’t yet know what it is capable of.”

Anthropic found no evidence of the models autonomously pursuing goals of their own.

Instead, they simply followed their instructions while mistakenly believing they were operating inside a closed testing environment.

The company noted that its capability evaluations typically run without the safeguards of its generally available models.

“The safeguards deployed on our generally available models would have blocked the behaviors identified,” wrote Anthropic.

‘Hey everyone, our AI can hack companies autonomously!’

Matt Warren, director of RMIT University’s Centre for Cyber Security Research and Innovation, said Anthropic and OpenAI’s recent scandals highlighted that generative AI is a “powerful tool”.

“[Generative AI] can be used to identify weaknesses in other IT systems,” said Warren.

“Due to their complexity, system vulnerabilities may not have been identified or patched before.”

He said both companies had taken an "interesting approach" by publicly revealing that their AI models had autonomously hacked external organisations, rather than quietly notifying those affected.

"Anthropic and OpenAI disclosure will raise awareness within cyber criminal groups of the capabilities of their AI systems, which could have potential negative impacts."

Anthropic said it has engaged independent AI evaluation organisation METR to conduct a third-party review of the incidents.