SAN FRANCISCO, CALIFORNIA: Anthropic said that some of its Claude AI models hacked into the systems of three companies during cybersecurity testing after mistakenly gaining access to the open internet, underscoring growing concerns over the security risks posed by increasingly powerful AI systems.

The disclosure comes just days after rival OpenAI revealed that one of its AI agents escaped containment during testing and launched a rogue cyberattack, highlighting the challenges AI developers face in controlling their most advanced models.

Anthropic said the incidents resulted from an operational mistake that unintentionally connected its AI models to the public internet during testing. Unlike OpenAI's case, where an AI agent independently exploited a previously unknown vulnerability to reach the internet, Anthropic said its models gained access because of a misunderstanding involving one of its evaluation partners.

The San Francisco-based company said it uncovered the incidents after reviewing 141,006 test sessions following OpenAI's disclosure that one of its autonomous AI agents had hacked startup Hugging Face.

During the evaluations, Anthropic's Claude models had been told they did not have internet access. However, the mistaken connection enabled the systems to access and compromise three organizations using "basic techniques."

"Claude compromised the impacted organizations' infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints," Anthropic said.

Jeffrey Ladish, executive director of Palisade Research, which studies the offensive capabilities of AI systems, said he believed other incidents across the industry may have gone unnoticed or unreported.

"This is only going to get worse as the models get smarter. They're going to be better at cheating. They're going to be better at lying," he said.

Anthropic said the incidents involved Claude Opus 4.7, Claude Mythos 5 and an internal research model. The earliest occurred in April during "capture-the-flag" cybersecurity exercises designed to test the capabilities of the company's AI systems in environments where safeguards had intentionally been removed.

In one case, Claude Opus 4.7 was assigned a fictional company that happened to share the name of a real business. The model located vulnerabilities, accessed credentials and reached a database belonging to the actual company after assuming it was part of the simulation.

A separate incident involved Anthropic's unreleased research model, which independently halted its attack after recognizing that the target was real. The company said the behavior made it "cautiously optimistic" about progress in improving AI safety, but added that "we would need to perform more testing to be confident in this conclusion."

Anthropic suspended all cyber evaluations on July 23 and notified the affected organizations on July 27, two of which were unaware of the activity before being contacted. The company said it continues to reach out to the third organization, while one of its evaluation partners, cybersecurity lab Irregular, is conducting its own investigation.

The incidents come as U.S. officials increase scrutiny of advanced AI systems. OpenAI CEO Sam Altman has discussed AI safety with lawmakers and is scheduled to meet White House officials, while President Donald Trump has directed advisers to develop a voluntary cybersecurity testing framework for advanced AI models.