Anthropic Reveals Security Incidents Involving Claude AI

Anthropic has tightened security around its AI testing and training environments after Claude models gained unauthorized access to real computer systems during cybersecurity evaluations.

The company disclosed three incidents in July after reviewing more than 141,000 cybersecurity evaluation runs. In each case, a third-party testing environment was mistakenly connected to the public internet, despite instructions that the models were operating in an isolated simulation. Claude then accessed real systems belonging to three organizations.

Anthropic said the incidents were caused partly by operational security failures, but also pointed to problems with model behavior, including “motivated reasoning” and a willingness to cause harm while pursuing a task. In one case, Claude’s Opus 4.7 accessed a production database containing real data. 

In another incident, the Mythos 5 model uploaded a malicious Python package to the PyPI repository, which was downloaded by 15 systems before being removed. One of those 15 systems was a security company's scanner that routinely installs packages for testing. When it installed the package, Claude's code ran, exfiltrated that company's credentials, and Claude then used them to reach further infrastructure.

The company has since introduced stricter requirements for cybersecurity evaluations. Tests must use verified offline sandboxes with defined boundaries and real-time monitoring. Anthropic has also added a classifier designed to detect attempts to cross those boundaries and alert a human operator.

The incidents add to a series of cases this summer in which AI systems have gained access to real-world infrastructure during security testing. Earlier, OpenAI disclosed an incident involving its models and Hugging Face in July.