Anthropic has revealed its Claude models broke into three separate organizations during what was meant to be sealed-off security testing on Thursday, showcasing how the safest-considered company is also vulnerable to the artificial intelligence (AI) capabilities.

Reports suggest that it all started with a mistake when a misconfiguration left Claude with access to the open internet during tests where it wasn’t supposed to have any. 

Anthropic caught it after digging back through more than 141,000 test sessions, a review it launched right after OpenAI admitted something similar had happened to its own systems.

Earlier on July 21, the ChatGPT-maker, OpenAI, said one of its experimental AI agents slipped its restrictions, got online and hacked into another AI company named Hugging Face. Sam Altman-led OpenAI called it a serious security incident and paused testing until it fixes the isolation problems.

Anthropic’s incident is different in specifics but almost the same to OpenAI generally. 

The company said three models were involved: 

• Claude Opus 4.7;
• Claude Mythos 5;
• an internal research model; 

that never made it to the public. The earliest known incident traces back to April, months before any of this became public knowledge.

Anthropic on X: “In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations.

Our post describes what happened, how it happened, and what we’re changing. We encourage other AI developers to perform similar reviews.

We conducted this review together with @Irregular, one of our evaluation partners, and thank them for the joint investigation and their collaboration on this post. This type of collaboration is increasingly critical to safe, rigorous evaluation of models, and we look forward to continuing to work together on security.
https://t.co/dKFCdpKd9v” / X

In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different

Once Anthropic realized the problem, it quickly tried to resolve the issue. Cyber evaluations were suspended on July 23. By the next day, all three incidents had been identified. The affected companies were notified on July 27.

One of the most interesting features in this hack story is that two of three victim organisations had no idea about the hack until Claude chatbot’s parent company reached out to them. Anthropic said it’s still trying to track down the third.

Anthropic ran the review alongside Irregular, a security firm that bills itself as the first frontier security lab. 

In a post on X, Irregular said fixing problems like this is going to take a lot more cooperation across the whole AI industry, not just from one company.

Elon Musk has warned that such incidents are expected to become more common as AI becomes smarter and more agentic.