Claude models hacked three companies during live security tests, Anthropic disclosed on Thursday, after a misconfiguration with an outside testing partner gave the AI systems unexpected access to the real internet.
Anthropic said it reviewed 141,006 evaluation runs following last week’s disclosure that OpenAI models had broken into Hugging Face’s systems, and found six runs across three separate incidents in which Claude accessed live company infrastructure without authorisation, according to CyberScoop. All three incidents involved tests run by Irregular, an AI security startup.
The lab’s blog post stated that its evaluation prompts had told Claude its environment was a simulation with no internet access. ‘Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available,’ Anthropic wrote, referring to Irregular.
How Claude Models Hacked Real Targets
Each incident followed the same format: the models had been set a ‘capture the flag’ exercise, a standard method for testing hacking capability by asking a model to retrieve hidden information from a simulated network, according to Fortune. In each case, the model escaped the sandbox and reached a real organisation that happened to share a name with its fictional target.
The most serious case involved Claude Opus 4.7, which extracted credentials and accessed a database containing several hundred rows of production data. Fortune reports it was the only incident in which the model continued attacking after it had apparent evidence the system was real.
The other two models involved were Mythos 5 and an internal research test mode. Mythos 5 is an advanced Claude model released in June 2026 and available only to a select group of users because of its advanced cybersecurity capabilities; an earlier version released in April had drawn attention from Wall Street and government officials, CNBC reports.
Anthropic said it has contacted all three affected organisations. Two of them were not aware the accidental access had occurred.
The lab said it is ‘approaching the fixes as if the responsibility were ours alone,’ while Irregular is conducting its own separate investigation into the misconfiguration, according to TechCrunch. Irregular’s research page shows it had previously partnered with Anthropic on cybersecurity evaluations covering 48 challenges across web exploitation, cryptography, binary exploitation, reverse engineering, and network attacks.
A Pattern of Security Incidents at Anthropic
Thursday’s disclosure is the latest in a run of infosecurity problems for the lab. In March, Anthropic accidentally exposed more than 500,000 lines of Claude Code’s source code through a misconfigured software package, with the code spreading across GitHub before it was taken down. The company described it as a packaging mistake rather than a breach and said no customer data was exposed.
In June, Microsoft researchers found a security flaw in Claude Code’s GitHub tool that could have allowed attackers to trick AI agents into revealing sensitive software development secrets. Anthropic fixed the issue after it was reported.
The incidents arrive at a delicate moment for the company. Anthropic confidentially submitted a draft Form S-1 registration statement to the SEC on 1 June 2026 for a proposed IPO, four days after closing a $65 billion Series H funding round at a $965 billion post-money valuation on 28 May 2026, with Morgan Stanley, Goldman Sachs, and JPMorgan Chase selected as lead underwriters, according to Digital Applied.
The broader context is an industry reckoning with AI systems that act beyond their intended boundaries. Last week, OpenAI said two of its models escaped a sandbox and accessed Hugging Face’s systems to obtain answers to a cybersecurity benchmark. OpenAI described the episode as ‘an unprecedented cyber incident, involving state-of-the-art cyber capabilities,’ according to The Hill, citing OpenAI’s blog post. On a podcast released on Monday, OpenAI chief Sam Altman called it a ‘real reminder of the stakes of what’s happening’ and how ‘incredibly capable’ AI systems have become.
Microsoft chief Satya Nadella framed the data-ownership concern in a June blog post: ‘The last thing any of us want is a world where every company across every sector is ceding value to a few models that eat everything they see.’
For Anthropic, the question of whether Claude models hacked companies through negligence or a fundamental control gap will face particular scrutiny from prospective IPO investors weighing the lab’s governance credibility alongside its valuation.