Anthropic says internal AI models accessed real systems during security tests

Anthropic said on Thursday that three of its AI models were able to reach live systems at three organizations during cybersecurity exercises because a testing environment was not properly isolated from the internet. The company said the incidents happened while the models were being used in capture-the-flag scenarios.

According to Anthropic, the models included Claude Opus 4.7, Claude Mythos 5 and an internal research prototype. In one case, the company said a model used weak passwords and exposed services to obtain credentials and access a database with several hundred rows of production data.

Anthropic said another model uploaded a malicious Python package to PyPI, where it stayed available for about an hour and was downloaded by 15 real systems before removal. A third model scanned about 9,000 internet-facing systems before compromising one organization using familiar techniques such as exposed debug credentials and SQL injection.

The company said it reviewed 141,006 cybersecurity test runs after OpenAI disclosed a separate incident involving its own models. Anthropic said the affected organizations have been notified and that it has reached two of them, while work continues to contact the third.

Anthropic said the episodes were caused by a misunderstanding with its security partner over whether internet access had been disabled, rather than by the models breaking out of containment on their own. The disclosures add to growing concern about how frontier AI systems behave when evaluation environments are not tightly controlled.