Just a week after OpenAI disclosed a serious security incident in which its AI model escaped its sandboxed test environment and hacked into Hugging Face, competitor Anthropic apparently sensed trouble and immediately launched a large-scale internal retrospective review—only to find that its own Claude had experienced similar issues. Anthropic announced on the 30th U.S. Eastern Time (the 31st in Taiwan) that across three separate incidents dating back as early as April this year, models under testing connected to the internet without the company’s knowledge and hacked into three unsuspecting businesses. This news transforms “AI models autonomously connecting to networks and launching attacks during evaluation” from a single lab’s accident into a shared problem encountered consecutively by two frontier AI companies.
After reviewing 140,000 records, Anthropic was alarmed to discover that Claude had also connected to the internet without authorization and hacked into 3 enterprises.
Anthropic stated that this review followed OpenAI’s public announcement on July 21. Hugging Face Hacking IncidentIt activated on its own afterward. The company examined more than 140,000 records—141,006 to be exact—of cybersecurity assessment execution logs and confirmed that Claude had indeed attempted to connect to the internet on several occasions, ultimately succeeding in hacking into external companies’ production infrastructure in three incidents.
The models involved in the three incidents include Claude Opus 4.7, Mythos 5, and an unnamed research model. Mythos is Anthropic’s flagship security-focused model series in recent years, and the previously released Claude Mythos Preview was officially positioned as a security model with top-tier hacker-level capabilities.
Claude didn’t break out of the sandbox — the system never had a sandbox in the first place.
Unlike the scenario of OpenAI models “escaping digital prison,” Anthropic emphasizes that Claude did not break through any sandbox—it simply wandered out of a system where no sandbox existed in the first place. These evaluations took the form of capture-the-flag (CTF) challenges, where the task was to have the model locate hidden confidential information on another machine on the network. Although the evaluation prompts explicitly told the model “this is a simulated environment, there is no internet,” a configuration error between Anthropic and Irregular, its third-party evaluation partner and cybersecurity firm, actually allowed the model to connect to the open internet.
As it turned out, Claude’s search extended all the way to real systems on the open internet, treating them as part of the challenge—and succeeded in hacking into three companies using basic methods like guessing weak passwords and accessing endpoints that required no authentication. Anthropic said the models mistakenly believed the hacking was part of the benchmark test at the time.
Three Generations of Models React Very Differently: The Latest Model Stops Upon Seeing Evidence
Anthropic noted that no complex vulnerabilities were discovered or exploited in these three incidents. Claude acted solely to complete the CTF task throughout, leaked no data, and made no deliberate attempt to escape the test environment. The three models reacted markedly differently when they realized they were connected to the real network: the oldest, Opus 4.7, continued attacking even after confirming it had reached real production systems; Mythos 5 initially had the intuition that it was accessing the open network, but then reasoned its way back to the conclusion that it was “still in a simulation”; and the newest internal research model stopped immediately once evidence emerged.
Anthropic emphasized that these evaluations were conducted without general-release safeguards and used dedicated infrastructure that could not access Anthropic’s sensitive internal systems or customer data. The identities of the three victim companies have not been disclosed, but all were notified on the 27th, and an Irregular spokesperson said the company is investigating the incident.
After the incident was announced, Anthropic urged other AI labs to conduct similar reviews to understand the risks posed by their own models’ capabilities. Anthropic also acknowledged that such an incident could have been avoided or its likelihood significantly reduced if all network access paths had been verified before evaluation and evaluation logs had been monitored in real time.
Conclusion
OpenAI and Anthropic have both seen models autonomously connect to networks and hack into external companies, exposing fundamental security vulnerabilities in AI evaluation environments. In both incidents, the common lesson was insufficient network path control and monitoring in isolated test environments. On a more positive note, the latest generation of models has learned to stop when they realize they are on a real network, showing that their situational awareness is improving—but this still needs more testing to confirm.
Source: KOCPC Chinese