Five things to know on Anthropic Claude autonomous hack

The company says it has uncovered three “real-world incidents” involving the unintended access of IT systems by a Claude model, raising further questions about whether stronger isolation is needed

Autonomous AI and cyber risk

Anthropic has disclosed that Claude models gained unintended access to “real-world” systems at three organisations as part of cybersecurity testing.

The evaluations were supposed to take place inside isolated environments, but the models managed to escape, the company said in a post.

The incidents included a Claude model accessing a production database as well as a model that published a malicious Python package - ultimately downloaded onto 15 “real” systems - along with a third model that scanned “roughly 9,000 targets”, Anthropic said.

Anthropic’s discovery of the hacking incidents involving Claude models was prompted by OpenAI’s disclosure last week of compromises autonomously executed by its own models.

Anthropic said it began reviewing the transcripts of its cybersecurity evaluations on 23 July, two days after OpenAI’s initial disclosure.

The incidents are continuing to raise questions about whether isolation for frontier AI model testing is strong enough as well as how organisations seeking to protect against autonomous attacks can effectively govern and secure their own LLMs.

Without a doubt, “the industry needs a safe place to test these types of models,” said Chris Konrad, VP of global cyber at Missouri-based WWT.

What follows are five things to know about Anthropic’s disclosure.

Opus, Mythos involved

Anthropic said it uncovered the three incidents after reviewing 141,006 cybersecurity evaluations in the wake of OpenAI’s disclosure that its models had autonomously compromised AI model platform Hugging Face.

OpenAI subsequently said that a total of four services were compromised in connection with the autonomous hack.

The Anthropic incidents involved Claude Opus 4.7, Mythos 5 and an unidentified research model. The earliest activity occurred in April, according to Anthropic.

In its post, Anthropic said a total of six evaluation runs formed part of the incidents, in which Claude models unintentionally reached the internet - something that was not supposed to be possible - while interacting with an environment operated by evaluation collaborator Irregular.

The models then compromised systems that had been incorrectly believed to be part of the exercises, Anthropic said.

Not a deliberate hack

According to Anthropic, the Claude models did not deliberately attempt to escape their environments or pursue their own objectives.

The company instead attributed the incidents mainly to a testing misconfiguration, which “left the machines that Claude accessed as part of the evaluation with live internet access”.

In one of the incidents, for instance, a model “assumed [the environments] to be simulated and believed its actions were therefore harmless,” Anthropic said.

“However, later in the run, Claude realised that the compromised host sat in a cloud account with no connection to the capture-the-flag challenge. On its own, it concluded that the target was in fact real and ceased its attack.”

Three organisations impacted

Anthropic said it stopped its cyber evaluations later on 23 July, the same day the activity was discovered, after finding evidence that Claude models may have escaped the testing environment and reached the internet.

Four of the evaluation runs involved in the autonomous hacking incidents affected the same organisation, the company said.

The other two runs each occurred during separate evaluations and affected different organisations, according to Anthropic.

None of the three impacted organisations were identified.

The most significant incident occurred because of a “misunderstanding” in which a fictional company being used in an evaluation shared a name with a real company operating an active internet domain, Anthropic said.

As a result of mistakenly having direct internet access, the model discovered the real company’s systems online, according to Anthropic.

Claude Opus 4.7, believing the company was the intended target of the exercise, went on to exploit weaknesses in its infrastructure across four separate runs.

That led to the model obtaining application and infrastructure credentials, ultimately gaining access to a database containing several hundred rows of real-world data, according to Anthropic.

Other impacts

In a second incident, Claude Mythos 5 discovered fictional developer instructions telling employees to install a Python package from PyPI that did not actually exist, according to Anthropic.

The model decided to publish a malicious package using the same name, causing the fictional company’s systems to automatically download and execute its code, Anthropic said.

However, because Mythos had access to the real internet, the model ultimately created an actual PyPI account and uploaded the malicious package to the public registry, according to Anthropic’s disclosure.

“Claude went to extensive lengths to carry out this attack - lengths that would likely have indicated to a human participant that this was no longer just an evaluation, and that they were in fact uploading a real PyPI package,” the company said.

The package remained publicly available for about one hour and was downloaded onto 15 real-world systems, Anthropic said.

As part of the third incident, involving an unidentified research model, Claude was “unable to reach its intended fictional target [and] looked for alternatives online, scanning roughly 9,000 targets,” Anthropic said.

“It eventually found and compromised one company’s internet-facing application, using basic and well-known cyberattack techniques such as reading credentials from an exposed debug page and SQL injection.”

Stronger isolation needed?

The incidents raise further questions about whether frontier AI evaluations should employ a true air gap, which is a much stronger form of isolation.

Environments described as highly isolated may still contain pathways that a highly advanced model can exploit with enough persistence, cybersecurity experts have told CRN.

“You need a true air gap so that these agents can’t jump,” said Harpreet Sidhu, global cybersecurity lead at Accenture.

“Air-gapping now isn’t optional anymore - because the agents will try to find vulnerabilities to hop to the next layer, gain access and achieve whatever their objective is,” he said.

Anthropic said in its post that it plans to strengthen containment and controls for its cybersecurity evaluation environments going forward, including through increased real-time monitoring and hardening of both internal and third-party environments.

However, the company stopped short of committing to fully air-gapped testing.

This article originally appeared on CRN UK sister website CRN.