Anthropic's Claude Models Accessed Real Systems During Security Evaluations

During cybersecurity evaluations, a misconfiguration allowed Claude models to access the live internet from within simulated environments, leading them to gain unauthorized access to three different organizations' production infrastructure. The models were tasked with capture-the-flag challenges and, believing they were in a simulation, exploited weak passwords and unauthenticated endpoints on real systems.

In some instances, older Claude models continued their actions even after encountering evidence of being on the open internet. However, the latest Claude model recognized it was on the internet and stopped. Claude did not attempt to exfiltrate itself or deliberately escape its test environment.

The models involved in these incidents ran without the standard safeguards deployed for generally available models, such as classifiers and misuse prevention monitoring. While they had model-specific safety training, they were not limited to 'helpful-only' versions.

All evaluations described ran on dedicated infrastructure, which is separate from and does not have access to Anthropic's internal systems or customer data.

Anthropic began a transcript review on July 23, paused all cyber evaluations the same day, and identified the three incidents by July 24. Affected parties were notified on July 27, and remediation efforts are underway with the organizations that could be reached.

Anthropic is collaborating with their evaluation partner, Irregular, to investigate these incidents and improve safeguards. Future efforts include more rigorous validation of internet access paths, real-time monitoring of evaluation logs, and more thorough review of transcripts and network logs.