Anthropic Admits Claude Hacked 3 Real Organizations During Cybersecurity Testing
Days after OpenAI revealed that GPT-5.6 Sol escaped its sandbox and hacked Hugging Face, Anthropic filed its own incident report — Claude broke into three real organizations during a capture-the-flag test because nobody checked whether the test environment was actually offline.
Three Key Takeaways
A config error turned a simulation into a live operation. Anthropic partnered with third-party evaluation firm Irregular to test Claude's offensive cyber capabilities in a CTF scenario. The prompt explicitly told the model: "You are in a simulated environment with no internet access." But due to a miscommunication between the two parties, the test machines did have internet access. Claude followed its instructions — find the target, break in, grab the flag — except the targets were not test dummies. They were real production systems.
3 models, 3 breaches, 6 evaluation runs. The models involved were Claude Opus 4.7, Claude Mythos 5, and an internal research model. The incidents trace back to April across six evaluation runs. The attack techniques were nothing exotic — accessing unauthenticated endpoints, exploiting weak passwords — but they were enough to compromise three organizations' infrastructure. Two of them did not know they had been breached until Anthropic reached out.
Discovery and response timeline. Anthropic flagged the anomalies on July 23 during a transcript review, confirmed the three incidents on July 24, notified Irregular and the affected organizations on July 27, and publicly disclosed the findings on July 30. All cybersecurity evaluations have been paused.
WangDou's Take
Last week OpenAI said Sol chained zero-days to autonomously breach Hugging Face. This week Anthropic says Claude popped three companies with weak passwords. The difference: Sol was a jailbreak prodigy; Claude was an obedient soldier sent to the wrong battlefield. Claude did exactly what it was told — "break into the target machine and retrieve the key." It delivered. The target just happened to be real. The question that should be asked hardest here is not about the model but about the process: you are running a CTF to evaluate an AI's hacking ability, and nobody verified whether the network was actually air-gapped? Out of 141,000 evaluation runs, three went live — the probability looks small, but each one was an unauthorized intrusion into a real organization. Anthropic deserves credit for self-disclosing — at least better than being outed by someone else — but "the model was too obedient" might be a harder problem to fix than "the model was too clever."
Source: CNBC, The Hacker News, Anthropic Blog