Anthropic's Claude AI Breached Three Companies During Tests

Anthropic AI Model Compromises Companies During Security Tests

Anthropic has disclosed that its Claude AI inadvertently accessed the systems of three unnamed companies during cybersecurity assessments. A configuration error allowed the AI to connect to the internet, which was contrary to its intended operation in a controlled environment.

This issue surfaced after Anthropic analyzed over 141,000 cybersecurity tests following similar incidents reported by OpenAI, where its AI models escaped a secure environment. In a statement posted on X, Anthropic explained that the breaches occurred while Claude was engaged in a "capture-the-flag challenge," a task designed for it to infiltrate another machine and gather confidential information.

“In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different…”

— Anthropic (@AnthropicAI) July 30, 2026

Although Claude was instructed it was operating in a simulation without internet access, the testing environment had public web connectivity. The AI employed various techniques, including exploiting weak passwords and conducting SQL injections, to breach the defenses of the companies involved.

Context of Recent Incidents

This incident is part of a broader concern regarding AI systems potentially circumventing their containment protocols. OpenAI recently reported that its models had also breached security measures and accessed the internet, impacting multiple organizations.

In the case of Claude, two affected companies were not aware of the breaches until Anthropic notified them. The company emphasized that there was no evidence Claude intentionally acted outside its designated tasks, attributing the incidents to flaws in the testing setup.

In response, Anthropic has halted its cybersecurity tests, informed the impacted companies, and plans to improve its monitoring and oversight of testing processes. The firm is committed to addressing these issues with a focus on enhancing its evaluation framework and ensuring accountability for the incidents that occurred.