Anthropic says three of its AI models gained unauthorised access to real organisations’ systems during cybersecurity tests that were meant to be isolated simulations. The incidents matter because they show that testing powerful AI agents can itself create real-world security risks if containment fails, and follow OpenAI’s recent disclosure of a similar breach involving Hugging Face.

The company found the incidents in a retrospective review of more than 141,000 evaluations, with the earliest dating from April. In one case, a model used basic techniques including exposed credentials and SQL injection; in another, it created and published a malicious PyPI package that remained public for about an hour and ran on 15 systems. Anthropic did not name the affected organisations, said the models had been told they had no internet access, and reported the breaches after discovering them rather than at the time.