Anthropic, the company behind the artificial-intelligence assistant Claude, has acknowledged that three of its models accessed the systems of three external companies on their own while taking part in cybersecurity tests. The announcement, published in the early hours of 31 July, comes barely ten days after OpenAI admitted a similar incident against the Hugging Face platform, and confirms that the problem of autonomous agents escaping their test environments is not an isolated case.
141,000 test sessions under scrutiny
The San Francisco-based company only detected the three incidents after launching a “large-scale” cybersecurity review in which it analysed more than 141,000 evaluation sessions, looking for evidence that its models had managed to access the internet from environments that should have been completely isolated. The first episodes date back to last April, according to the company itself.
The models involved are Claude Opus 4.7, Claude Mythos 5 and an internal research prototype. In all three cases, the method used was hardly sophisticated: weak passwords, unauthenticated access points and exposed credentials. Anthropic insists that none of its models found or exploited complex vulnerabilities, although that does not diminish the seriousness of what happened.
A human error behind the leak
The cause of the leak differs from that of the OpenAI incident. In the case of Sam Altman’s company, its model found an unknown vulnerability in the sandboxed environment and managed to escape to the open network on its own. In Anthropic’s case, it was all due to human negligence: the models were told they had no internet access, but one of the test environments, managed by Irregular, an external company that collaborates with the firm, was misconfigured and did have access to the real network. The models, convinced they were still inside the simulation, considered the real systems they found to be part of the exercise.
The tests were of the kind known as “capture the flag” (CTF): the model is told there is a secret piece of data hidden on another machine and that it must steal it, an exercise designed to measure the AI’s offensive capability within a closed, fictitious environment. The problem is that the prompt the model received said exactly the opposite of what was actually happening.
Different reactions to the same dilemma
The most striking thing about Anthropic’s statement is that the three models reacted differently when they suspected their targets might be real. Opus 4.7 concluded that the environment was fictitious and carried on. Mythos 5 confirmed that the systems were real and, even so, continued attacking. Only the internal prototype stopped the exercise. In one of the episodes, Mythos brushed against a science-fiction script: it wanted to obtain a phone and money to create an email account that would allow it to publish code on a public Python repository, without success in any of its attempts.
A warning for the whole sector
Lukasz Olejnik, visiting researcher at the Department of War Studies of King’s College London, notes that “the fact that the exit was easier lowers the technical level required, but does not change the underlying fact: autonomous agents compromised real organizations. The evaluation infrastructure, the scoping and the monitoring failed.”
Anthropic has not revealed the names of the three affected companies, which in no case suffered a level of access comparable to that of Hugging Face in the OpenAI incident. Two of them have already been notified and the company is still trying to contact the third. In its conclusions, Anthropic argues that the models “did what they were asked to do” and that it found no evidence that they pursued their own goals, although most acted “from a false belief about whether the environment was real”.
The announcement comes a day after more than 1,200 employees of leading artificial-intelligence companies signed a letter asking to moderate the pace of progress of these models, and adds pressure to a sector that already accumulates several open fronts in security and control. The question is no longer whether autonomous agents can act on their own, but when it will happen again.
