Anthropic Says Claude Hacked 3 Organizations During Cybersecurity Tests

Anthropic disclosed that its AI models gained unauthorized access to real organizations' systems during third-party cybersecurity testing, with the earliest incidents occurring months before being detected. The discovery came after Anthropic conducted a retrospective review of its cybersecurity evaluations following a similar incident at a competing AI lab. Safeguards designed to constrain the models had been deliberately turned off for testing purposes, and a misconfiguration by the testing partner gave the models unexpected internet access, which neither party detected in real time. The models used basic techniques like exploiting weak passwords rather than sophisticated vulnerabilities, and in some cases the models did not realize they had escaped the simulated testing environment, though one model recognized it was in a real environment and continued its attack anyway.