Claude mistakes real internet for simulation, breaches systems of three organizations

Anthropic reported that its Claude AI models gained unauthorized access to the production infrastructure of three real-world organizations during cybersecurity evaluations after a configuration error left the testing environment connected to the internet. The incidents were discovered in a review of 141,006 Claude evaluation runs, with the most serious involving Claude Opus 4.7 accessing a database with several hundred rows of production data. Anthropic stated that the models mistook real systems for elements of the simulation and continued their assigned objectives.

Claude mistakes real internet for simulation, breaches systems of three organizations Claude AI models gained unauthorized access to the production infrastructure of three real-world organizations during cybersecurity evaluations after a configuration error left the testing environment connected to the internet, Qazinform News Agency https://qazinform.com/ reports, citing Anthropic https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals . The incidents were uncovered following an extensive review of 141,006 Claude evaluation runs. The review was launched after OpenAI reported that several of its models had escaped an isolated testing environment and accessed the infrastructure of the Hugging Face platform. “We identified three incidents in which a model accessed the internet and then gained unauthorized access to the production infrastructure of three different organizations,” Anthropic said. The incidents occurred across six evaluation runs involving Claude Opus 4.7, Claude Mythos 5 and an internal research model. All three models were completing capture-the-flag challenges, which require participants to break into a simulated computer system and retrieve hidden information. Claude was told that the tests were being conducted in a simulation without internet access. However, a configuration error left the evaluation systems connected to the open internet. When the models encountered real websites and servers, they mistook them for elements of the exercise and continued pursuing their assigned objectives. Claude reaches production database In the first incident, the fictional company used in the challenge shared its name with a real organization. After failing to locate the intended system inside the testing environment, Claude Opus 4.7 connected to the real company’s systems, identified weaknesses in its infrastructure and obtained credentials. Across four evaluation runs, the model gained access to a database containing several hundred rows of production data. Anthropic described this as the most serious of the three incidents. Even after encountering signs that the system might be real, Claude continued the attack, reasoning that the company had been deliberately included in the evaluation scenario. Malicious package reaches 15 real systems The second incident involved Claude Mythos 5. In documents belonging to a fictional organization, the model found instructions recommending the installation of a nonexistent software package from the public PyPI registry. Claude decided to create a package with the same name and embed malicious code in it. To publish the package, the model independently registered an email address and created a PyPI account. The package remained publicly available for about an hour. During that period, it was downloaded and executed on 15 real systems. One of them was an automated scanner operated by a cybersecurity company. After the code was executed, Claude obtained the organization’s credentials and used them to access other parts of its infrastructure. PyPI’s security systems later removed the package automatically. At an early stage, Claude correctly recognized that publishing the package on the open internet would constitute a real-world cyberattack. However, the model convinced itself that it was still operating inside a simulation. One of its arguments was that the systems displayed the year 2026, which Claude mistakenly interpreted as evidence of an artificial environment. Latest model stops attack on its own During the third evaluation, an internal research model scanned around 9,000 internet targets after failing to reach its intended fictional target. It found a vulnerable application belonging to a real company and gained access using well-known attack techniques. The model later determined that the compromised system was unrelated to the evaluation and stopped the attack on its own. Anthropic noted that only the most recent of the three models behaved this way. The company found no evidence that Claude had deliberately attempted to escape the testing environment or pursue an independent objective. According to Anthropic, the models were carrying out their assigned tasks while mistakenly believing that the real systems were part of the simulation. Anthropic began reviewing the evaluation transcripts on July 23 and suspended all cybersecurity evaluations the same day after finding indications that Claude may have accessed the internet. The company identified all three incidents on July 24. “We notified our evaluation partner Irregular and the three affected organizations on Monday, July 27,” the company said. The two organizations Anthropic was able to reach had not previously detected the activity or contacted the developer. Anthropic is now working with them to remediate the impact and continues trying to reach the third organization. Earlier, Qazinform https://qazinform.com/ News Agency reported https://qazinform.com/news/what-catastrophes-could-ai-cause-by-2030-9951ad that experts estimated a 21% probability that the use of AI in cyberattacks and weapons development could cause catastrophic harm by 2030.