Anthropic found 3 Claude breaches of outside systems during tests

Anthropic said Thursday that a review of more than 141,000 cybersecurity evaluation runs found three cases in which Claude models reached the internet during testing and accessed the real systems of three outside organizations. The company said the exposure happened while Claude was interacting with a testing setup from third-party evaluation partner Irregular and internet access was mistakenly left available. Anthropic said the models used basic methods, including weak passwords and unauthenticated endpoints, and did not exfiltrate themselves or deliberately try to escape the test environment. The models involved included Opus 4.7, Mythos 5 and an internal research test model. Anthropic did not identify the affected organizations but said it had contacted or tried to contact all three.