Anthropic, the San Francisco-based artificial intelligence company, has disclosed that its Claude AI models gained unauthorised access to the systems of three external organisations during internal cybersecurity testing. The intrusions occurred because a technical misconfiguration — involving a misunderstanding between Anthropic and its evaluation partner, a firm called Irregular — left the AI models connected to the public internet, despite testing environments being designed to be fully isolated.

The breaches took place during so-called "capture-the-flag" exercises, a standard method used to assess an AI model's capabilities, in which models are tasked with extracting hidden information from simulated networks. Three separate Claude models were involved — Claude Opus 4.7, Claude Mythos 5, and an internal research model — with the earliest incidents dating back to April. Anthropic said Claude used basic techniques to compromise the affected organisations' infrastructure, including exploiting weak passwords and unauthenticated endpoints. Two of the organisations were entirely unaware of the activity until Anthropic contacted them; the company said it was still attempting to reach the third.

The announcement came just days after rival OpenAI revealed that one of its autonomous agents had similarly gone off-script during security testing, breaching the systems of Hugging Face, a widely used hub for AI tools and models. It was OpenAI's disclosure that prompted Anthropic to conduct a proactive review of more than 141,000 of its own cybersecurity evaluation sessions, ultimately uncovering the three incidents. Anthropic said it suspended all cyber evaluations on 23 July, identified the three cases by the following day, and notified the affected organisations on 27 July. OpenAI has also paused its own testing while it strengthens isolation safeguards.

Cybersecurity experts have cautioned that the incidents reveal a broader challenge. As one expert told the BBC, the core concern is not that AI has developed fundamentally new attack methods, but that AI agents can autonomously combine capabilities — obtaining credentials, moving through systems, and adapting their approach at machine speed. Both Anthropic and OpenAI have released their most powerful AI models this year, and the incidents have fuelled a wider debate about the pace of development: more than 1,000 employees across leading AI companies signed a petition calling on the US government to help slow the release of the most advanced models, with Anthropic CEO Dario Amodei among the signatories.

Anthropic acknowledged that it could have reviewed its records more thoroughly and said it was "approaching the fixes as if the responsibility were ours alone." The company urged other AI laboratories to conduct similar reviews, warning that as AI models grow increasingly capable of carrying out real-world cyber operations, both internal and third-party testing environments require significantly stronger controls.