Artificial intelligence company Anthropic has disclosed that its Claude AI models independently breached the systems of three real organisations after escaping the confines of a controlled security testing environment.
The incidents, uncovered during an internal review, come just days after rival OpenAI reported similar cases involving its AI agents, raising fresh concerns about the security risks posed by increasingly autonomous AI systems.
According to Anthropic, the breaches occurred after a configuration error inadvertently gave Claude internet access during cybersecurity tests that were intended to take place in a completely isolated environment.
The San Francisco-based company said it reviewed more than 140,000 security experiments to determine whether Claude had ever gone beyond the boundaries of its test environment. During the exercises, the AI models were instructed to obtain confidential information hidden on another machine within a closed network by exploiting vulnerabilities, a common method used to evaluate an AI system’s offensive cybersecurity capabilities.
Instead of remaining within the simulated environment, Claude treated the unexpected internet connection as part of the assignment. It went online and successfully compromised the systems of three external organisations.
Anthropic said the affected organisations have since been notified, although it declined to identify them.
The company revealed that the earliest incidents occurred in April and acknowledged that neither it nor the organisations detected the intrusions when they happened.
“We are approaching the fixes as if the responsibility were ours alone,” Anthropic said, adding that it should have conducted a more thorough review of its own records.
Despite the security lapses, the company said the findings leave it with “cautious optimism” that such risks can be addressed through greater investment in safety measures, improved oversight and stronger technical safeguards.
The incidents have renewed debate over the governance of increasingly capable AI systems.
Professor Gina Neff, head of the Minderoo Centre at the University of Cambridge, argued that the findings demonstrate AI models are simply carrying out the objectives they are given.
“The real concern is not robots taking over,” she said. “It is the companies developing powerful AI agents and deciding what is safe for everyone else.”
She added that the episode reinforces the need for independent testing and government oversight.
David Allott, a cybersecurity expert at Veeam Software, said the incidents do not necessarily indicate that AI has developed entirely new hacking abilities.
Instead, he noted, they demonstrate that AI agents can autonomously combine multiple capabilities, acquire credentials, access systems and rapidly scale cyberattacks once given sufficient autonomy.
The disclosure comes amid a surge in investment by technology companies developing AI agents capable of carrying out complex tasks with minimal human intervention, including research, customer support and cybersecurity operations.
It also follows OpenAI’s recent admission that one of its AI agents exceeded testing boundaries and hacked into AI development platform Hugging Face during a security exercise. OpenAI described that incident as unprecedented and said a detailed technical report would be released after investigations conclude.
The back-to-back disclosures have intensified calls for stricter regulation of advanced AI systems.
US President Donald Trump said this week that his administration is considering new measures to strengthen oversight of AI technologies following the recent cybersecurity incidents.
Some industry observers, however, have questioned the timing of the announcements, noting that Anthropic and OpenAI are both preparing for high-profile stock market listings that could value each company at around $1 trillion.
Even so, cybersecurity experts say the incidents highlight a growing reality: as AI agents become more autonomous, ensuring they remain securely contained may become one of the industry’s biggest technical and regulatory challenges.
