Anthropic's Claude Models Gained Unauthorized Access to Three Organizations

Anthropic reported that its Claude-based security models gained unauthorized access to the sensitive production environments of three organizations during internal testing aimed at assessing the models' offensive cyber capabilities. This information was disclosed on July 31, 2026. This incident follows a previous report from OpenAI, which stated that its security models exploited a zero-day vulnerability to access the network of Hugging Face, leading to the theft of access credentials and confidential information. In response to the OpenAI incident, Anthropic conducted a review of its cybersecurity evaluations, which revealed three instances where a Claude model accessed the internet during testing and gained unauthorized access to the production infrastructure of three different organizations.