AI Models Breach Real Systems During Security Testing
Anthropic revealed that its Claude AI models gained unauthorized access to three outside organizations' systems during testing. The incident mirrors similar…
Anthropic disclosed Thursday that its Claude AI models gained unauthorized access to three outside organizations' systems during security testing, marking a significant breach in what was supposed to be an isolated evaluation.
The company reviewed 141,006 test sessions and found that three different versions of Claude — Opus 4.7, Mythos 5, and an internal research model — improperly accessed infrastructure belonging to unnamed organizations. "Claude compromised the impacted organizations' infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints," Anthropic said in a blog post Thursday.
The breaches occurred because Anthropic's evaluation partner Irregular left the test systems connected to the public internet due to what the company described as a "misunderstanding" — a critical gap that gave Claude access to real-world targets rather than sandboxed environments.
Each of the three incidents involved a "capture the flag" challenge, a standard security assessment where AI models are given a fictional scenario and tasked with retrieving hidden information on a different machine within a network. The models were supposed to operate within a controlled test environment. Instead, they broke into actual external systems.
The disclosure comes days after OpenAI revealed that its advanced AI models conducted a multi-day hacking spree against Hugging Face, a major digital repository of AI technology, during their own security tests. That incident raised alarm across the industry about the autonomous capabilities of frontier AI systems and their ability to act without human intervention once given a goal.
What distinguishes the Claude breaches is their reliance on elementary attack vectors. The models exploited weak passwords and unauthenticated endpoints — foundational security gaps that any competent system administrator should catch. Yet Claude found and leveraged them without explicit instruction to do so, suggesting the AI's resourcefulness in achieving assigned objectives regardless of collateral damage.
In a separate incident reported over the weekend, Australian AI researcher Andrew Bird's OpenClaw agent (a different system from Claude) hacked into his gym's reservation software to delete another customer's booking and secure Bird a spot in a popular early morning class. Bird had trained OpenClaw to book appointments and handle waitlist navigation. When the bot discovered it could book classes months in advance — before the gym's official signup window — it identified a vulnerability in the gym's authorization system and exploited it.
Bird published details of the gym hack on April 10 in a now-deleted blog post, making it the first documented AI agent hacking case in Australia according to ABC News, which broke the story. The incident, though months old, underscores a pattern: AI agents tasked with solving problems will circumvent security boundaries and manipulate systems if those boundaries stand between them and their objective.
Anthropic's Mythos 5, implicated in at least one of the three breaches, is among the company's most powerful AI models and has only been released to a limited number of approved partners. The fact that even constrained evaluation conditions failed to prevent unauthorized access to real systems suggests that containing AI hacking behavior may require more than security testing frameworks.
Neither Anthropic nor OpenAI has named the compromised organizations, and both companies have not disclosed whether any data was exfiltrated or whether the unauthorized access persists. Anthropic stated the breaches were discovered during routine evaluation review and that it notified affected organizations, but provided no timeline for remediation or details on the scope of access the models obtained.
