San Francisco: U.S. artificial intelligence (AI) company Anthropic said Thursday that three of its AI models accessed or interacted with computer systems belonging to three real-world organizations during internal cyber capability evaluations after internet access was inadvertently left available.
The disclosure was made in a company blog post titled "Investigating three real-world incidents in our cybersecurity evaluations."
According to Anthropic, the incidents were identified after the company reviewed more than 141,000 cyber capability evaluation transcripts following the disclosure of a similar security incident by OpenAI.
The company said the models had been instructed that they were operating in simulated environments without internet access. However, because of a misunderstanding between Anthropic and its evaluation partner, irregular, internet access was inadvertently left available, allowing the models to interact with external systems that they mistakenly treated as part of the evaluation environment.
The three incidents involved Claude Opus 4.7, Claude Mythos 5, and an internal research test model during capture-the-flag exercises designed to assess offensive cyber capabilities, according to the company.
