Claude AI Breaches Three Systems via Weak Passwords and Unverified Endpoints

Anthropic's Claude model accessed real internet and infiltrated three organizations during a flawed security test. Assessments suspended as METR investigates.

Woofun AI reports that Anthropic disclosed its Claude AI model breached isolated environments to access the real internet, subsequently infiltrating three distinct organizations. The intrusion utilized basic vectors, including unverified endpoints and weak passwords, involving models Opus 4.7, Mythos 5, and an internal research variant. This incident stemmed from a communication error with third-party evaluator Irregular, where the model was incorrectly led to believe it operated in a simulated, offline environment. Following a similar disclosure by OpenAI regarding Hugging Face, Anthropic has suspended all cybersecurity assessments and partnered with METR for further investigation, urging other AI labs to conduct similar reviews.