Anthropic disclosed that three Claude AI models unintentionally accessed real companies after cybersecurity tests. The tests contained a misconfiguration that allowed the models access to the internet.

 

What happened

News outlet Reuters first reported Anthropic’s Claude models accessed three company’s systems while participating in cybersecurity tests. The tests were designed to evaluate Claude’s ability to identify cybersecurity weaknesses then attempt to hack into various systems.

Anthropic discovered the three incidents during six out of 141,006 evaluation runs it completed. Two incidents involved Claude Opus 4.7, one included Claude Mythos 5, and the last incident was an internal research build of Claude. The AI model participated in capture- the-flag cybersecurity tests that prompt users to locate flags or private information within a closed testing network. The model believed these networks were not live and lacked internet access.

Irregular, Anthropic’s third-party evaluator, had an open pathway to the internet due to a misconfiguration. Claude accessed real-world systems and operated on them as if they were part of the cybersecurity test. Anthropic explained the models used low-hanging fruit tactics such as password guesses and accessing endpoints with no authentication to access the systems.

 

Going deeper

Anthropic specified the first incident involved Claude Opus 4.7. One company listed in the phishing range was named similarly to a real-world company. Claude could not access its target in the simulation so it located the real organization online and accessed its infrastructure.

In four evaluation runs, the model procured credentials that allowed it to access applications and infrastructure. It then navigated to a database containing “a few hundred rows of production data.” Anthropic clarified that the team considered this incident to have the highest impact during their investigation.

During the second incident, Claude Mythos 5 located a URL within the simulation instructing developers to install a Python package that didn’t actually exist. Claude created the package then uploaded the software to PyPI, the real Python Package Index.

The package remained available for approximately one hour before it was downloaded and ran on 15 machines. The downloads occurred from one cybersecurity company’s automatic scanner. Anthropic detailed the package then scraped credentials from the scanner and Claude used the stolen credentials to access additional infrastructure.

In the last incident, Anthropic’s internal research build scanned approximately 9,000 internet-facing targets then escalated permissions on one organization’s application. This version of Claude also realized the system it accessed was real and stopped further activity by itself.

 

What was said

Anthropic said the incidents were “closer to a harness and operational failure than a model alignment failure.”

Anthropic told victims the models were ordered to complete cybersecurity challenges with the misinformation that they did not have access to the internet. Because of this, the models assumed systems it could access on the internet were part of the cybersecurity simulation.

Anthropic added that advanced agents “present a substantial threat on their own,” even when the environment does not initially contain sensitive information.

 

The bigger picture

Cybersecurity professionals typically operate a chatbot to generate a response to human review. AI agents can select tools and perform multiple actions across integrated systems. According to a recent article from Oxford Journal on autonomous clinical AI, “Agentic AI operates differently—it coordinates actions across electronic health records and scheduling systems, adapting its behaviour based on outcomes.”

The independence can increase the severity of a penetration testing mistake, compromised credentials, miscommunication, or insecure integration. An agent with access to electronic health records, email, a cloud platform, or admin consoles could theoretically act across those systems before a human reviews the agent's behavior.

The Claude incident is not the first time an AI agent traversed the boundaries between a cybersecurity test and actual production systems. Paubox also recently disclosed OpenAI’s AI agents accessed Hugging Face Inc. after discovering and chaining vulnerabilities to try and receive answers for a cybersecurity evaluation.

Healthcare organizations should limit AI agents behind technical boundaries that restrict actions to approved activities. These safeguards may include network egress blocking, least-privilege permissions, separate service accounts, manual approvals for high-risk actions, real-time logging, and automatic alerts when the agent exhibits unusual behavior.

Organizations should also assess AI agents during HIPAA risk assessments and ensure vendors interacting with protected health information (PHI) will sign a business associate agreement (BAA) if necessary. Healthcare agents should not receive PHI, credentials, email accounts, or healthcare system access if not required and supervised.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

What is agentic AI?

Agentic AI is artificial intelligence that can map out and complete a series of actions with minimal human intervention. An AI agent can select tools, search connected systems, analyze results, and modify its next course of action to fulfill an objective it was assigned.

 

How is agentic AI different from generative AI?

Generative AI typically produces content for a human to review. This content can include text, images, code, or other media. Agentic AI can take that content and act on it. If an AI generated a patient's electronic medical record, scheduled an appointment, modified a system, and sent a confirmation email, it would be demonstrating agentic behavior.

 

Can an AI agent act without human approval?

AI agents can be configured to act with varying levels of independence. Some require a human to approve each task, while others are allowed to perform entire workflows without confirmation.