Anthropic has disclosed that its Claude AI models hacked into three organisations while the start-up was testing cyber capabilities, a week after OpenAI reported a similar incident.
The group said Claude gained unauthorised access to outside companies during an evaluation of its cyberoffensive tasks. “A misunderstanding” gave Claude access to the internet in its testing environment, when it was meant to be blocked, Anthropic said.
The disclosure comes a week after rival OpenAI admitted that two of its models hacked into AI start-up, Hugging Face while the model developer was testing its technology this month. The models broke out of their testing environment through a software vulnerability to access the internet and carry out the cyber attack.
Anthropic said the OpenAI incident prompted it to review its own cybersecurity evaluations, which led it to identify three incidents out of more than 141,000 investigated.
RM Block
“In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner [Irregular], this was not the case and internet access was available,” the company said in a blog post on Thursday.
The cyber evaluations were all so-called “capture the flag” tasks, which instruct the AI to reverse-engineer, analyse or exploit a vulnerable system to recover hidden information known as the flag.
In one example, Claude was given a target of a fictional company which shared a name with an active website domain. The agent – an AI program that can operate on its own based on human instructions – exploited vulnerabilities in the company’s digital infrastructure, extracted information and obtained access to a database containing several hundred rows of production data.
The announcement adds to growing concerns about the safety of AI systems, which are now carrying out real-world hacks even during pre-deployment testing.
Anthropic, which is gearing up for an IPO as early as this year, said it halted its cyber evaluations as soon as it identified that Claude may have accessed the internet.
The incidents occurred on three different Claude models: Opus 4.7, Mythos 5 and an internal research test model.
Mythos, which was released to a limited number of partners, sparked global concern over its advanced cyberoffensive capabilities, including the ability to detect and exploit software vulnerabilities.
“Ultimately, many factors contributed to these incidents but, consistent with a blameless postmortem culture, we’re approaching the fixes as if the responsibility were ours alone,” the company said in its statement.
It added that it would expand its monitoring of evaluation transcripts “for unexpected behaviour” and conduct “more rigorous assurance work with the vendors we rely on”. – Copyright The Financial Times Limited 2026
