# Three organizations got breached in a controlled exercise — and > Source: > Published: 2026-07-31 10:35:12+00:00 # Three organizations got breached in a controlled exercise — and ## What actually happened The test setup put [Claude](/en/tags/claude/) in the position of an external penetration tester. It had access to a virtual machine with internet, email, a code interpreter, and terminal commands. Over the course of the exercise, it independently enumerated systems, identified exploitable services, used known CVEs, and moved laterally once it gained a foothold. Anthropic's own reporting frames this as "dual-use" capability — the same skills that let Claude write Ansible scripts and debug API integrations can be redirected to attack infrastructure. Nothing about this is magic. It's tool use plus an agent loop. Claude iterated: run command → read output → plan next step → execute → repeat. When a specific exploit failed, it pivoted to another method. That persistence, not raw intelligence, is what made the difference. ## The operator system prompt is the real story From a prompt engineering perspective, what stands out is the constraint layer. The system prompt apparently spelled out scope limitations: only target authorized assets, don't cause unnecessary damage, preserve evidence, and disengage if you hit something unexpected. Despite those guardrails, Claude still completed a multi-stage intrusion path. If you've used [Claude Code](/en/tags/claude%20code/) for repo work, you already recognize this pattern. The same loop of `bash` , `grep` , file reads, and tool calls that helps you refactor code can be pointed outward. The only difference is the environment and the instructions in the system prompt. That's a subtle but crucial point: safety isn't going to come from refusing to generate a fishing email — it has to come from operational control over the agent's permissions, isolation level, and scope bounds. ## What this means for AI workflows and security The scary takeaway is obvious, but the defensive angle matters more. Anthropic's safety policies here are pragmatic: run the agent in a sandbox, give it a bounded task, and log everything. Teams deploying AI agents in production should borrow that same discipline. Treat the agent as a junior operator with root access — you don't just hand it credentials and hope for the best. You give it a container, a least-privilege role, audit trails, and a kill switch. For red teamers, this is a signal. Autonomous agents can potentially scale reconnaissance and initial exploitation across many targets while a human reviews the decisions. For blue teams, it's a warning about detection latency. An [AI agent](/en/tags/ai%20agent/) can run thousands of commands in the time a human takes to write one report. There's also a subtle prompt engineering lesson: the agent didn't need to be a perfect penetration tester; it needed to be a competent Linux operator that could read error messages and adjust. Most LLM agents already have that baseline. The bottleneck is tool access, not reasoning. So yeah, Claude hacked three organizations during cyber tests. It wasn't a skynet moment — it was a well-scoped experiment with clear guardrails. But it proves that autonomous agents can execute a real kill chain end-to-end. Whether that's terrifying or useful depends entirely on the guardrails you put around the agent, not on the model itself. Anyone building AI-assisted security tooling should read the report carefully, because the operational patterns are more important than the headline. [Three separate security incidents at Anthropic reportedly match 1h ago](/en/news/4508/) [Claude "Escape" Hype vs. Reality: What the Eval Really Showed 5h ago](/en/news/4486/) [Title: Mythos Cyber Skills: Born from Sandbox Hacking 20h ago](/en/news/4410/) [Model Collapse: Are New Coding LLMs Training on Old AI Slop? 1d ago](/en/news/4360/) [Claude Code Workflow: Why Closed-Source Logic Often Wins 1d ago](/en/news/4346/) [Claude Code Workflow: Balancing Open Weights and Safety 1d ago](/en/news/4345/) [Next Gander: Android File Viewer That Asks for Zero Permissions →](/en/news/4519/)