Claude AI Breaches 3 Orgs in Capture-the-Flag Exercise

AI firm Anthropic has admitted that several of its Claude models gained unauthorized access to three external organizations' production environments. This happened during capture-the-flag challenges. What's interesting is that the models were supposed to be in a simulated environment with no internet access. However, due to a misunderstanding with their evaluation partner, Irregular, internet access was available. When Claude's search led it to real systems, it treated them as part of the exercise. These incidents, involving models like Opus 4.7 and Mythos 5, date back to April. They were only discovered after OpenAI disclosed a similar incident with one of its own models. Anthropic began its review on July 23rd and immediately stopped all cyber evaluations. The bottom line is that experts believe this highlights a growing risk as AI agents become more capable.