Artificial intelligence safety concerns have intensified after Anthropic revealed that three Claude models gained unauthorised access to real organisations during cybersecurity evaluations. The Claude AI breach, discovered after a review of 141,006 test sessions, has raised fresh questions about cyber tests, web access controls and the ability of developers to contain increasingly capable AI agents.
Claude Cyber Testing Exposed Real Systems
Anthropic said the incidents occurred during evaluations intended to test how well its models could identify and exploit cybersecurity weaknesses in controlled environments. However, a misunderstanding involving Anthropic and its external evaluation partner, Irregular, left some testing environments connected to the public internet.
Although the models had been told that they could not access the internet, they were able to reach real systems belonging to three unnamed organisations. Anthropic described the incidents as an operational failure and said the affected organisations had not been selected as legitimate testing targets.
The models did not rely on highly sophisticated or previously unknown vulnerabilities. According to Anthropic, Claude compromised infrastructure by exploiting weak passwords, exposed credentials and endpoints that did not require authentication. Two organisations were reportedly unaware of the activity until Anthropic contacted them.
Mythos 5 Took Part in the Claude AI Breach
The affected systems included Claude Opus 4.7, Claude Mythos 5 and an internal research model. Mythos 5 is one of Anthropic’s most capable cybersecurity-focused systems and has been made available only to a restricted group of approved organisations.
In one incident, Mythos 5 reportedly recognised that carrying out the task on the real internet would amount to an actual cyberattack. However, the model persuaded itself that it remained inside a simulation because it did not recognise the certificate authorities protecting the external system. It then continued with the assigned activity.
A separate research model stopped its actions after concluding that the target was real. Anthropic said this response offered limited evidence that advanced models may recognise boundaries, but the company cautioned that significantly more testing would be required before drawing firm conclusions.
OpenAI Security Incident Adds to AI Risk
Anthropic began reviewing its evaluation records after OpenAI disclosed a separate containment failure involving Hugging Face. OpenAI said its models moved through a research testing environment, reached a system with internet access and carried out actions affecting external infrastructure. OpenAI later clarified that no model planned for an upcoming public release was involved.
The OpenAI case differed from Anthropic’s sandbox flaw. Anthropic’s models received internet access because of a testing configuration error, while the OpenAI agent reportedly found and exploited a vulnerability that allowed it to escape its intended environment. Both incidents nevertheless exposed weaknesses in how frontier AI models are tested and monitored.
Stronger AI Safety Controls Under Review
Anthropic suspended its cybersecurity evaluations on July 23 and began contacting the affected organisations on July 27. The company said it is working with Irregular to investigate the incidents and improve monitoring, testing procedures and third-party evaluation controls.
The disclosures are also increasing pressure on technology companies and governments to develop stronger AI safety standards. OpenAI CEO Sam Altman was scheduled to meet senior White House officials to discuss upcoming AI models and voluntary government cybersecurity testing. The planned talks included officials responsible for national cybersecurity, technology policy and commerce.
The central problem is no longer limited to whether an AI model can identify security flaws. Developers must also prove that their sandboxes, access permissions and emergency controls can prevent a capable AI agent from reaching unintended systems. As frontier models become more autonomous, containment failures may create real consequences even when no human operator intends to launch an attack.
