The company began reviewing test logs after OpenAI revealed that its agent hacked Hugging Face.
Apparently, OpenAI isn’t the only company whose AI models have independently breached other organizations’ systems. Anthropic has published a report admitting that its AI models broke free from their testing environment and infiltrated three different organizations—none of which were aware of the breach until notified.
After OpenAI disclosed the incident—in which an AI agent it was testing exploited vulnerabilities to connect to the internet and hack into Hugging Face—Anthropic launched a large-scale review of its own tests. The company specifically searched for evidence that its Claude models had accessed the internet when they shouldn’t have been able to. It turned out the models accessed the internet in three instances and then “gained unauthorized access to the production infrastructure of three different organizations.”
Three distinct Claude models were involved: Opus 4.7, the cybersecurity-focused Mythos 5, and a prototype not intended for general release. All were engaged in a capture-the-flag challenge when they broke free. The models were tasked with locating the “flag”—a piece of secret information—hidden on another machine within Anthropic’s internal network. Their objective was to break into that machine to retrieve the flag.
Unlike OpenAI’s case, however, the models didn’t exploit a vulnerability to gain internet access. Instead, they escaped the confines of their testing environment due to human error. Anthropic instructed the models via prompt that they had no internet access—but this wasn’t accurate. They did have internet access “due to a misunderstanding” between Anthropic and its evaluation partner. When the models discovered open internet access and encountered the systems of the three organizations, they treated those systems as part of the exercise and breached them. Anthropic clarified that the models did not deliberately attempt to escape their testing environment.
The models used basic techniques to infiltrate the organizations—such as exploiting weak passwords—and did not leverage sophisticated vulnerabilities. Anthropic noted that its latest model halted upon recognizing it was connected to the internet, whereas its older model continued attacking the affected organization regardless.
Anthropic acknowledged that the company and its evaluation partner could have prevented these incidents by rigorously validating all internet access pathways before initiating tests—and by conducting more frequent, thorough test reviews. Additionally, the models’ behavior might have differed if they’d been explicitly informed from the outset that they did have internet access.
The company notified its evaluation partner and the three affected organizations on July 27—four days after beginning its review of test transcripts. Two of the affected organizations were unaware they’d been breached. Anthropic is still attempting to contact the third.
