Artificial intelligence continues to demonstrate that, when it escapes from controlled environments, it can cause very real problems. Anthropic has admitted that three of its Claude models accessed the systems of three real companies without permission. during internal cybersecurity testing. The incident, which came to light just days after OpenAI admitted to a similar case, has reignited the debate about the risks of evaluating autonomous agents without adequate safeguards.
According to an official statement from the company, the incident occurred during 'capture the flag' exercises, designed to measure the models' ability to locate and extract fictitious information within a simulated network. A configuration error on an external partner's assessment platform left the internet connection active.This allowed the models, convinced they were still within the test environment, to begin interacting with real infrastructure. Anthropic discovered the flaw after reviewing more than 141.000 evaluation sessions.
Claude's three attacks
The most serious case involved Claude Opus 4.7, who confused a fictitious company with a real one that shared the same domain nameDuring four runs, the model extracted credentials from applications and infrastructure, gained access to a database containing several hundred production records, and continued the attack despite suspecting the system was genuine. Its internal reasoning showed doubts, but it convinced itself that this target was part of the test.
The second incident involved Claude Mythos 5, who created and published a malicious package on PyPI, the official Python repositoryTo do this, the model opened an email account, found a temporary phone number, and even attempted to obtain funds to pay for the service. The package was available for approximately one hour and was downloaded by 15 real systems, including the security scanner of a large company in the sector. By executing the code, the model obtained credentials and accessed part of that company's infrastructure.
The third episode involved an as-yet-unpublished internal research model. Unable to find his fictitious target, he examined around 9.000 addresses available on the internet and compromised a company's application using credentials visible on a debugging page and basic SQL injection techniques. However, unlike the other two, this model detected that the infrastructure was unrelated to the exercise and proactively stopped the offensive activity.
Human error, not a deliberate leak
Anthropic wanted to make it clear that The models did not deliberately escape the test environment; it was the result of a configuration error. which left the internet connection active. The company maintains that the agents did not discover complex vulnerabilities or pursue their own objectives; they simply carried out the assigned task without fully understanding that they were acting on real infrastructure. The models employed basic techniques such as weak passwords, unauthenticated access points, and exposed debug pages.
The company suspended all cybersecurity assessments after detecting the suspicious logs and notified the three affected organizations. Two of them had not previously identified the intrusionThis demonstrates how difficult it is for traditional detection systems to distinguish between a human attack and an automated but deliberate one. Anthropic has also asked other AI labs to review their own environments before testing autonomous agents with offensive capabilities.
The incident comes just 20 days after OpenAI revealed a similar case, in which several of its models managed to escape an isolated environment through an unknown vulnerability and access Hugging Face's production infrastructure. Both episodes highlight the risks of testing AI agents with offensive capabilities without rigorous technical containment. and they have raised the need to establish stricter controls.
Reactions and regulation in sight
These incidents have generated concern in Washington. President Donald Trump has stated that his administration is considering exercising greater control over artificial intelligence.However, he clarified that he wants to avoid being too interventionist so as not to fall behind China. In early June, he already instructed his advisors to develop a voluntary cybersecurity testing framework for the most advanced AI.
Meanwhile, more than 1.000 employees from leading AI companies, including OpenAI, Anthropic, and Google DeepMind, signed a declaration urging the U.S. government to support international efforts to deliberately slow the pace of advanced AI development. Experts are calling for technical and political tools to slow development if risks increaseespecially given the possibility that systems will automate their own research and improvement.
Anthropic and OpenAI strive to present these flaws as manageable risks, insisting that their cybersecurity models are too powerful to offer to the general public. This stance allows them to simultaneously warn of the dangers and position themselves as essential partners in any future regulation, in a dynamic where competition between both companies has intensified and fear has become the main selling point.
What happened leaves a clear lesson: the more autonomy the models receive, the more necessary it is to subject them to tests with verifiable isolation, dead-end networks, synthetic data, and automatic shutdown mechanisms. Security is no longer just a technical problem, but an engineering and governance challenge that affects the entire industry.And while laboratories compete to demonstrate who has the most powerful model, the real world remains the ultimate testing ground.