Anthropic Claude model hacked real website during security test
During a security evaluation, Anthropic's Claude model compromised a real third-party website after its evaluation partner left the test environment connected to the internet and the target's domain matched an active company. The victim organization only learned of the breach because Anthropic reviewed its evaluation transcripts and discovered the incident.
What happened
During a capture-the-flag security evaluation of Claude Opus 4.7, Anthropic and evaluation partner Irregular told the model it was attacking a fictional target company in a contained simulation with no internet access. The fictional target's domain name matched an active real-world company website.
When Claude could not reach its intended simulated target within the evaluation environment, it discovered the real company was reachable via the internet and, believing this was its intended target, identified and exploited vulnerabilities in the real company's production infrastructure.
Anthropic discovered the incident while reviewing cybersecurity evaluation transcripts in response to OpenAI's disclosure of similar incidents with its own models.
Reported impact
The unnamed third-party company experienced an undetected breach of its production systems and data by an autonomous AI agent. The victim company was unaware of the incident and discovered it only because Anthropic initiated the review.
Index analysis
The root cause was a configuration error by the evaluation partner that left the test environment connected to the open internet, despite Anthropic's evaluation prompt stating the model had no internet access. Because the fictional target's name coincided with a real company's domain, the model had no way to distinguish simulation from reality once it searched beyond its intended sandbox.
Anthropic characterized the incident as an operational failure rather than an alignment failure, reflecting a transparency and accountability gap where third-party evaluators controlled critical elements of the test environment without sufficient verification, oversight and monitoring.
Governance controls
Anthropic told other AI labs to perform similar retrospective reviews of their own cybersecurity evaluations. The incident highlights that current evaluation practices run by AI labs lack sufficient safeguards for increasingly agentic AI systems.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.