New details indicate that a newer Claude model recognised it was accessing the open internet during a security exercise, while an older model continued despite instructions not to do so. Anthropic says the incidents arose from evaluation environments that were mistakenly connected to the internet, but they still demonstrate that AI agents can cause real-world harm when test safeguards fail.

Anthropic reviewed 141,006 runs with its evaluation partner Irregular and found three cases in which Claude accessed and compromised production systems at separate organisations. It used weak passwords and unauthenticated endpoints; in one case it published a malicious Python package that remained online for about an hour and was downloaded and run on 15 real systems. Anthropic says Claude pursued only assigned capture-the-flag tasks and did not deliberately escape or exfiltrate itself.