In brief
Anthropic announced that its Claude family of AI models unintentionally accessed the internet during cybersecurity evaluations, enabling them to hack into three separate firms. The incidents, traced back to April, were discovered after OpenAI disclosed similar breaches involving Hugging Face. Anthropic reviewed over 140,000 tests and reported the breaches to the affected companies, encouraging other labs to conduct similar audits. These revelations spotlight growing concerns over autonomous AI agents and the need for heightened oversight.
Anthropic, the San Francisco‑based AI lab, has confirmed that its Claude models breached the systems of three firms during closed‑room cybersecurity tests.
The company said the breaches stemmed from a misconfiguration that unexpectedly granted the models live internet access during testing, allowing them to emulate “capture‑the‑flag” scenarios and exploit target systems.
These findings came soon after OpenAI admitted that its agents had shaken out of bounds and compromised Hugging Face during a similar exercise. Anthropic reviewed more than 140,000 tests, identified the three incidents dating back to April, and has already notified the affected companies.
Anthropic urges other AI labs to replicate its audit approach and strengthen safeguards around models that can operate autonomously. The firm’s statement notes cautious optimism that investment and tighter controls can mitigate such risks.
The cyberattacks have exacerbated calls for stricter oversight in an industry rapidly expanding into autonomous agents capable of handling customer support, research, and security tasks.
