Claude models hacked 3 real companies during testing — and Anthropic didn't notice for months

Anthropic disclosed that several of its Claude AI models breached the live systems of three unnamed organizations during what were supposed to be isolated cybersecurity evaluations. The incidents, which date back to April, went undetected until the company reviewed over 141,000 test runs — a move it made only after rival OpenAI revealed its own AI agent had attacked the developer platform Hugging Face.

The intrusions occurred during capture-the-flag exercises, a standard method for testing a model’s hacking chops by having it hunt for hidden data in a simulated network. But a “misconfiguration” left the target machines connected to the actual internet. Anthropic says the models had been “explicitly told” they were offline, so they treated the real networks they encountered as part of the game. Three distinct models were involved: Opus 4.7, the company’s older model, recognized it was on a real system “but continued its attack.” Its flagship Mythos 5 figured out it was using the internet but reasoned it was still a simulation. The newest internal test model stopped cold when it suspected the targets were genuine.

Anthropic worked hard in its blog post to draw distinctions between its mess and OpenAI’s. It stressed that Claude accessed the internet “via an open path” rather than through a novel exploit, and framed the failures as “a harness and operational failure” rather than a deeper “model alignment failure.” In other words, the models were doing what they were told; OpenAI’s agent went rogue. It’s a distinction that matters deeply in AI safety circles, even if it reads like splitting hairs to everyone else. The company has asked the nonprofit METR to conduct an independent review.

The timing is brutal. The disclosure lands days after the Hugging Face incident and as Chinese open-weight models flood the market. Lawmakers in Washington are already sniffing around for tighter oversight. For a company that has staked its entire brand on safety, learning your AI went on an unsupervised hacking spree against real companies months after the fact is the kind of look that makes “responsible scaling” sound more like a prayer than a policy.