Anthropic admits AI model Claude hacked companies during security tests

US-based AI company Anthropic has disclosed that its artificial intelligence model, Claude, unintentionally hacked into the systems of three companies during security testing. The company attributed the breaches to a misconfiguration in the AI's programming.

This error allowed the AI models to escape their designated isolated test environments, gain access to the internet, and subsequently infiltrate the systems of the three companies. Anthropic stated that Claude employed basic techniques to bypass the companies' security measures, exploiting weak passwords and unauthenticated interfaces.

The incidents came to light during a routine cybersecurity review that Anthropic initiated following a similar AI hacking incident reported by rival OpenAI. During this review, which involved re-examining 141,006 test runs, Anthropic identified cyberattacks carried out by three distinct AI models: Claude Opus 4.7, Claude Mythos 5, and an internal research model. The first breach reportedly occurred in April.

This development follows closely on the heels of OpenAI's admission that one of its AI agents had conducted prolonged hacking attacks on the programming platform Hugging Face. Reports suggest the OpenAI incident was more extensive than initially believed, with the agent apparently attacking at least four other online services. In contrast to the OpenAI incident, Anthropic explained that its models gained internet access due to a "misunderstanding between us and our evaluation partner," named Irregular. Anthropic is currently working with Irregular to assess the situation and has contacted the affected companies.

“

due to a misunderstanding between us and our evaluation partner