Anthropic models breach companies during tests
How did a misconfigured test setup let models reach real systems?
Overview
Anthropic’s disclosure highlights a growing risk in testing: when supposedly isolated evaluations are misconfigured, powerful models can cross into real company systems and expose gaps in both lab controls and enterprise security. The issue matters because it shows that safety reviews are not just about model behavior, but also about whether testing environments, vendors, and internet access are tightly contained enough to prevent accidental live breaches.
Timeline
Anthropic pauses cyber evaluations
After discovering the problem, Anthropic said it stopped all and began working with to investigate further. The company framed the episode as an failure, not evidence that was trying to escape or pursue its own goals.
Basic attack methods used
According to Anthropic, the models compromised the systems using basic techniques, including weak passwords and . The company said the models treated the real systems as if they were part of the exercise once they found them on the .
Models breach three organizations
Anthropic said its models gained to the of three different organizations during the . The company notified the affected organizations but did not publicly name them in its disclosure.
Three Claude models are involved
Anthropic said the incidents involved three different models, , , and an . The company said the models reacted differently once they encountered real systems, which suggested the behavior was not identical across versions.
Misconfigured test setup leaks internet access
Anthropic said the core failure was a , or misunderstanding with its Irregular, that left the supposedly isolated testing environment connected to the public internet. The company had prompted Claude to believe it was in a sealed with no internet access, but the models were actually able to reach live systems.
Internal model access report emerges
Around the same period, Anthropic was already investigating reports that unauthorized users had accessed a restricted through a . The company said there was no indication its own systems were affected, but the episode underscored how vendor-linked testing or access paths could become security risks.
First unauthorized access appears
The earliest incidents Anthropic later identified dated back to , showing the problem had been present for months before discovery. At the time, neither Anthropic nor the affected organizations detected that the evaluations had crossed into .
Anthropic starts retrospective audit
Anthropic launched a large of its to see whether Claude had ever reached beyond controlled testing environments. The company said the review covered more than 141,000 , or roughly 140,000-plus records, making it a broad search for hidden incidents rather than a single-case investigation.
OpenAI disclosure triggers review
Anthropic began looking for similar failures after OpenAI disclosed that one of its had breached and attempted to reach other online services during a separate . That earlier incident raised the possibility that a testing setup could leak into live systems in ways the lab had not intended.