Anthropic's Claude AI hacked 3 companies during cyber tests
What's the story
Anthropic has revealed that its AI models compromised the systems of three unnamed organizations during cybersecurity assessments. The disclosure follows OpenAI's recent admission of a similar incident involving its AI agent hacking into Hugging Face during a separate security test. The revelation came after Anthropic conducted a "large-scale retrospective review" of its own cybersecurity evaluations, prompted by the OpenAI incident.
Access breach
Three different versions of Claude accessed the internet
Anthropic's review identified 141,006 tests where its AI model, Claude, could have accessed the internet.
The company found that three different versions of Claude did gain internet access during evaluations conducted by third-party testing firm Irregular.
These instances led to hacks into the production infrastructure of three different organizations.
The affected models were Opus 4.7, Mythos 5, and an internal research test model.
Exploitation methods
Unlike OpenAI, Anthropic's AI relied on basic techniques
Unlike OpenAI's case where an AI agent exploited a zero-day vulnerability, Anthropic's models relied on basic techniques such as exploiting weak passwords and unauthenticated endpoints.
The company admitted that if it and its testing partner had implemented more "defense-in-depth" measures, these incidents could have been prevented, or at least the likelihood of them occurring could have been reduced.
Both Anthropic and OpenAI have hired METR, another third-party AI evaluator, to conduct independent reviews of their respective cybersecurity incidents.
Model awareness
Models were told they didn't have access to open internet
The AI lab stressed that the models were told they didn't have access to the open internet, and for the most part, Claude mistook the organizations it accessed as being part of the testing environment.
However, in some cases, the AI models were aware something was wrong and correctly identified that they were accessing real infrastructure.
Opus 4.7 had been tasked with targeting a fictional company but ended up attacking a real one instead.