Anthropic reveals that Claude hacked 3 companies, the AI was out of control

During a test, OpenAI lost control of two of its most advanced AIs. The pair quickly found themselves online and set about attacking an open-source platform. Following this historic security incident, Anthropic, OpenAI’s main rival, decided to launch a massive audit of its evaluation logs.This audit was intended to verify whether Claude had been able to escape from secure environments and access the internet. Anthropic says it wanted to ensure that no incident comparable to OpenAI’s had occurred.

In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different…

— Anthropic (@AnthropicAI) July 30, 2026

Also read: OpenAI makes an unexpected revelation about the cyberattack launched by a cheating ChatGPT

Three AIs out of control at Anthropic

The start-up quickly obtained suspicious transcripts. Three of its Claude models managed to escape from their digital prison. Three distinct incidents involving six test sessions in total were identified by Anthropic’s teams. All three incidents occurred during conventional cybersecurity exercises. The exercises involved asking the AI to infiltrate a fictional system to retrieve hidden information. In each case, the instructions given to Claude explicitly specified that it had no internet access.

“We identified three incidents in which a Claude model reached the Internet from, or by interacting with, a third-party evaluation environment, and then gained unauthorized access to the live systems of three distinct organizations,” explains Anthropic.

Unfortunately, there was a misunderstanding between Anthropic and Irregular, one of the external partners tasked with designing test environments. As a result of this major misunderstanding, the test computers actually had direct network access. Claude Opus 4.7, Claude Mythos 5, and an internal research model soon took advantage of this to break out and end up on the Internet, without any oversight from Anthropic. The first incidents date back to April 2026. In plain terms, they went undetected for several months before the audit. If the OpenAI/Hugging Face affair had not broken out, Anthropic might never have become aware of its AIs’ escape.

Credential theft and malicious packets

During four exercise sessions, Opus 4.7 discovered that a real company had the same name as the fictional company at the heart of the test scenario. Convinced that it was indeed its target, the AI identified and exploited vulnerabilities in the company’s infrastructure. After siphoning off credentials, Claude was able to access a database containing hundreds of pieces of confidential information.

For its part, Claude Mythos 5 discovered, in its test environment, that it needed to install a certain Python package via PyPI, the major public registry of Python software. However, this package did not actually exist. The AI therefore decided to create the package itself… by slipping malicious code into it. Claude found a way to put the malicious package online, within reach of any developer.

“Claude believed that the package registry it was using was part of the simulation”, says Anthropic.

To publish this booby-trapped package, Claude first had to create a PyPI account, with a valid email address and phone number. The chatbot found a way to circumvent all these requirements. Once online, the booby-trapped package remained accessible to everyone for about an hour. During this brief period, 15 computer systems downloaded and installed it, unaware that it was a trap, including a company’s security scanner, a tool that automatically installs new Python packages to check that they are safe. By using the booby-trapped package, Claude was able to steal that company’s credentials. A second company was therefore hacked by an out-of-control Claude.

When the AI realizes its mistake

Finally, Anthropic’s research model scanned roughly 9,000 potential targets across the Internet. The model eventually settled on a company, whose application it compromised.Good news: the AI then realized that the company was outside its testing environment. On its own initiative, this version of Claude interrupted its cyberattack. The company emphasizes that only its latest model understood the situation and ended the exercise without being told to.

In response, Anthropic suspended its cybersecurity evaluations and strengthened oversight of its testing infrastructure. In parallel, the start-up launched an independent review of its practices with the help of an organization called Model Evaluation & Threat Research. This nonprofit organization specializes in the independent assessment of the risks posed by the most advanced AI systems.

This revelation has the hallmarks of a controlled communications strategy. Mirroring OpenAI, Anthropic seems to be seizing the opportunity to showcase, through an incident during a test, the intelligence of its AI models. The two AI giants are benefiting greatly from the spotlight these incidents have brought them, as their IPOs loom. The two laboratories, which embody the generative AI revolution, have both confidentially filed with the SEC (Securities and Exchange Commission), the guardian of the U.S. markets.

👉🏻 Follow tech news in real time: add 01net to your Google sources, and subscribe to our WhatsApp channel.