Artificial intelligence company Anthropic revealed that three of its Claude AI models gained unauthorised access to three real-world organisations during cybersecurity evaluations. The company said a configuration glitch allowed the models to connect to the internet from secured testing environments.
Anthropic discovered the incidents after reviewing more than 141,000 cybersecurity evaluation sessions. The audit began after OpenAI disclosed a similar incident where one of its AI agents accessed external systems during an internal security exercise.
Cybersecurity expert David Allott told the BBC, “The broader lesson is not necessarily that AI has developed a fundamentally new attack capability. Instead, it is that AI agents can combine capabilities, obtain credentials and system access to take actions autonomously, while adapting scope and scale at machine speed.”
Anthropic clarified that the models did not exploit sophisticated zero-day vulnerabilities. Instead, they relied on basic security weaknesses exposed by the unintended internet connection. The company stressed that the incidents resulted from operational failures in the testing environment rather than autonomous malicious behaviour by the AI models.
The incidents come as tech firms pour billions of dollars into developing AI agents that can independently perform tasks ranging from research and customer support to cybersecurity.
As of now, Anthropic has paused all cybersecurity evaluations involving internet access and launched a review of its testing infrastructure. Anthropic says that it has informed the relevant parties, improved its monitoring processes, and is collaborating with its testing partner to ensure such situations do not happen again.
The disclosure comes just days after OpenAI reported that one of its autonomous AI agents breached Hugging Face during a controlled cybersecurity exercise. These two events raise concerns about the safety standards of AI agents.
Also Read: Apple Upgrade Leasing Model May Reach Middle East Markets