Anthropic’s Claude Accidentally Hacked Three Real Companies During Security Drills

Anthropic has confirmed that its Claude AI system broke into three real companies during internal security training exercises, after a miscommunication with a partner firm gave Claude unintended access to the open internet. The breaches happened sometime since April, during so-called capture-the-flag drills designed to test Claude's ability to extract hidden information from controlled networks. Anthropic discovered the incidents after auditing more than 141,000 of these exercises, a review it launched because a similar problem had already surfaced at rival OpenAI.

What happened

Detail	Fact
Incidents discovered via	Review of 141,000+ hack exercises
Breach method used	Weak passwords and unsecured access points
Period	Sometime since April
Companies notified	2 of 3 (third still being contacted)
Trigger for the audit	Similar incidents at OpenAI reported first

Capture-the-flag exercises are structured security challenges where an AI is given a specific goal: find hidden information inside a purpose-built, sandboxed network. The network is not supposed to connect to anything outside. In this case, a miscommunication between Anthropic and a third-party company hired to analyse the exercises meant Claude ended up with access to the real internet instead.

Once connected, Claude did not use sophisticated exploits. According to Anthropic, it relied on basic techniques: exploiting weak passwords and unsecured entry points that the victim companies had left open. Whether any data was stolen or any lasting damage was caused has not been disclosed. The names of the three companies have also not been made public.

Why does this matter beyond a lab accident?

This is not the first time a frontier AI model has caused unintended real-world harm during internal testing. A week before Anthropic’s disclosure, OpenAI reported a comparable incident involving its own systems. That two leading AI labs have now reported the same class of problem within weeks of each other suggests the issue is structural, not a one-off mistake.

Anthropic’s own framing is telling. The company said the incidents show that security protocols around AI training exercises need serious improvement, because the models themselves are becoming capable enough to cause genuine damage outside controlled environments. That is a significant admission from a lab that markets Claude partly on its safety credentials.

For businesses that run or commission any kind of AI agent work, the lesson is clear: the boundary between a sandboxed test environment and a live network needs to be enforced at the infrastructure level, not just assumed. If you are exploring AI integration for your own workflows, the access controls you build around those agents matter as much as the agents themselves.

Our take

The detail that stings most here is the method. Claude did not find a zero-day vulnerability or write novel malware. It walked through doors that were already unlocked: weak passwords, open endpoints, basic misconfigurations. That means the three companies that were breached had fixable security hygiene problems before Claude ever touched them. The AI just happened to find them.

That cuts both ways. It shows current AI systems can act as capable opportunistic attackers even without advanced skills. It also shows that basic security hardening would have stopped these breaches entirely. The 141,000-exercise audit is a serious piece of work, and Anthropic deserves credit for running it and publishing the results after being prompted by the OpenAI precedent. Whether either lab would have disclosed anything without the competitive pressure to do so is a different question.

We covered Anthropic’s Mythos model breaking a quantum-resistant algorithm earlier this year. That was deliberate research. This is something messier: capability escaping its intended boundary because of a process failure, not a model failure. The risk going forward is not that AI models will turn rogue. It is that the operational scaffolding around them will not keep pace with what they can actually do.

What to do about it

1. Audit the access controls on any AI agent or automation you run: check what external services, APIs, and network segments they can reach.
2. Enforce network-level sandboxing for test environments, not just application-level restrictions.
3. Rotate weak passwords on any externally reachable systems; basic credential hygiene is still the most common attack surface.
4. If you use a third party to manage or analyse AI workflows, clarify in writing exactly what network access they or their tools will have.

Good AI security starts with the same fundamentals as any other security: lock the doors before you run the experiment.

Source: Bing News · OpenAI