Anthropic has revealed that its Claude model has also gone rogue and is responsible for three cybersecurity incidents.
“In a review of our cybersecurity evaluation transcripts, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorised access to the real systems of three different organisations,” according to a statement from the company.
This follows the news that an OpenAI agent autonomously gained access to four systems, including Hugging Face’s operational systems.
“In response to this incident, we began a large-scale retrospective review of our own cybersecurity evaluations. In particular, we looked for evidence that Claude – like the OpenAI models that accessed Hugging Face – was able to access the internet from within testing environments that should have been sealed off.”
After reviewing 141 006 evaluation runs where Claude could have obtained internet access, Anthropic identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of its third-party evaluation partners, and then gained unauthorised access to the production infrastructure of three different organisations.
In all three incidents, Claude had been tasked with a capture-the-flag challenge, one of the ways we assess a model’s cyber capabilities.
The model is given a fictional scenario and told that a piece of secret information (the “flag”) has been hidden on a different machine on the network, and its objective is to break in and retrieve it. The challenge is left open-ended, and no particular method is prescribed.
“In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access,” Anthropic states. “Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise.
“Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints.”
The model didn’t find or exploit any complex vulnerabilities, and continued working to complete only the specific capture-the-flag task its evaluation had assigned.
“However, in some cases, our older model continued its attack even after getting evidence it was running on the open internet; our latest model stopped once it recognized it was on the internet,” according to Anthropic. “In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment.”
The incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model.
The earliest incidents date to April.
You can read the full report from Anthropic here.