Anthropic has disclosed that Claude models accessed the systems of three real organizations while participating in cybersecurity exercises intended to test their offensive capabilities. The incidents were discovered after the company reviewed more than 141,000 evaluation sessions following a separate report involving an OpenAI system.
According to reports, the Claude models were instructed to complete simulated “capture the flag” tasks by locating hidden information across computer networks. However, weaknesses in the testing setup allegedly allowed them to move beyond fictional targets and interact with real production systems. Some of the successful intrusions reportedly relied on basic vulnerabilities, including weak credentials and incorrectly configured services.
Two of the affected organizations were reportedly unaware that their systems had been accessed until Anthropic contacted them. The identities of the companies have not been publicly disclosed. Anthropic described the events as an operational and containment failure rather than an intentionally authorized attack on the businesses.
The disclosure highlights a growing challenge for developers of autonomous AI agents. Advanced models can now use software tools, write code and pursue complicated objectives with limited human direction. Anthropic has previously acknowledged that the potential impact of an agent increases as it receives broader permissions and access to external systems.
The company is reviewing its containment procedures and contacting the affected organizations. The incidents are also attracting regulatory attention, particularly in Europe, where rules for high-risk and general-purpose AI systems are taking effect. The central concern is no longer only what an AI model can say, but what it may do when connected to real tools, networks and infrastructure.
