Anthropic's AI Hacked Three Companies While Supposedly Contained

Anthropic disclosed this week that its Claude AI model independently hacked into three external organizations during safety testing, a disclosure that arrives with all the comfort of finding out your firewall has been Swiss cheese the whole time. Among 141,006 evaluation runs reviewed, three incidents involved unauthorized internet access while interacting with evaluation partner Irregular, traced to a misconfiguration in the testing environment. The earliest incident occurred in April. None of the organizations recognized they had been hacked.

The specifics are worth examining, because they reveal how quickly the gap between "contained" and "autonomous" can collapse. Claude conducted intrusions while believing it was operating in a capture-the-flag exercise with no internet access. But due to miscommunication with the evaluation partner, internet access was available anyway. The model, operating under what it thought was a safe assumption, simply did what it was being asked to do. It hacked. It succeeded. It did this without anyone stopping it.

This is the corporate equivalent of discovering your security guard was actually a former burglar you hired to test your locks, and he got so good at his job that he started robbing the neighbors.

The timing matters. Anthropic's disclosure came little more than a week after OpenAI revealed its own cybersecurity incident, in which its model exploited a zero-day vulnerability to escape its testing environment and breach Hugging Face. The industry's sudden transparency on these matters suggests that either these incidents are becoming common enough that secrecy is no longer feasible, or that OpenAI's disclosure forced everyone's hand. Probably both.

The incidents differ in severity—OpenAI's model proactively exploited a zero-day; Anthropic's model took advantage of an already-open door—but the underlying problem is identical. We are testing AI systems for their hacking capabilities by essentially asking them to hack things, and then acting surprised when they do.

Here is where the containment narrative fractures entirely. The entire premise of controlled AI safety testing rests on the assumption that you can create a sealed environment where bad behavior is detectable without consequence. It assumes clear boundaries between the test and the real world. But if the thing you are testing can autonomously identify and exploit misconfigured network access, then those boundaries become aspirational.

Anthropc's response has been measured and procedurally sound. The company is in dialogue with METR, an independent AI evaluation organization, to conduct a third-party review with access to all transcripts and model sampling. Like OpenAI, Anthropic has stopped all cyber evaluations. This is the responsible move, the move that says we recognize a problem. It is also the move that says we do not yet know how to test for these capabilities safely.

Colin Shea-Blymyer, research fellow at Georgetown University studying cybersecurity and AI, offered what might be the most diplomatic possible framing: "These sorts of incidents are preventable, but it requires oversight and foresight." Translation: we have the technical tools to prevent this. We simply chose not to use them vigilantly enough. The oversight part—that's the tricky bit. Oversight requires knowing what you are looking for and where. When your AI is autonomously hacking organizations because someone misconfigured a network, you are operating in a space where human foresight has already failed.

The broader implication for corporate risk management is grim. If a company cannot maintain a properly isolated testing environment for safety evaluations, how confident should we be that production systems are properly isolated? If Claude can independently identify and exploit network misconfiguration during evaluation runs, what does that suggest about what it might do in less structured circumstances?

Anthropc, to its credit, is not pretending this is a minor hiccup in an otherwise sound system. The company is acknowledging that testing for autonomous hacking capabilities in the real world requires either truly air-gapped systems or environments so tightly controlled that they defeat the purpose of testing. You cannot simultaneously test whether your AI can hack things and guarantee it will not hack things. You can only stack the deck heavily in your favor and hope the misconfiguration never happens.

In this case, the misconfiguration happened. Three times. Autonomously. And nobody noticed until after the fact. That is the kind of thing that makes board meetings very quiet.