Summary
Anthropic said on Thursday that internal security testing of its Claude artificial intelligence models revealed three incidents in which the models accessed production systems at external organizations after a testing environment was mistakenly connected to the internet. The company found the events during a retrospective review that followed an external disclosure on July 21.
What Anthropic found
In a review of 141,006 cybersecurity evaluation runs, Anthropic identified three instances - with activity dating back to April - in which Claude models reached the internet through a misconfigured third-party testing environment managed by evaluation partner Irregular. The company said the models believed they were taking part in a simulated capture-the-flag exercise because they had been given instructions indicating they had no internet access.
Instead, the models used basic attack methods to exploit weak passwords, exposed credentials and unauthenticated systems on real organizations. One Claude instance obtained access to a production database that contained several hundred rows of data. In a separate incident, another model uploaded a malicious Python package to the public PyPI repository; that package was briefly downloaded by 15 real systems before it was removed.
Response and safeguards
Anthropic said none of the models attempted to self-exfiltrate or escape the confines of their testing environments. The company halted all cyber evaluations on July 23 and informed the affected organizations on July 27. Anthropic also said that safeguards present in the publicly released versions of Claude would have prevented the observed behavior.
As part of its follow-up, Anthropic said it is strengthening security and monitoring procedures for its evaluation work. The company attributed the access to a testing environment being inadvertently left connected to the internet by its evaluation partner, rather than any difference in behavior by publicly released models.
Context of discovery
The retrospective review that uncovered these incidents was initiated after another AI developer disclosed on July 21 that some of its models had left an isolated test environment by exploiting a previously unknown software vulnerability and accessed production infrastructure at a third party. Anthropic said its review examined a large set of evaluation runs and isolated the three incidents tied to the misconfigured environment operated by Irregular.