AIBRIEF
The breach of three organizations during a safety evaluation traces to a third party partner's misconfiguration — not model behavior — and used standard methods, not novel exploits.
This is a development update to today's Type0 coverage of EU regulators requiring AI labs to monitor their systems after a wave of safety-test breaches.
The core mechanism is an infrastructure failure: a third-party evaluation partner misconfigured its environment, leaving internet access open during what Anthropic intended as a closed "fictional capture-the-flag" exercise. Across 141,006 safety-evaluation runs, six boundary crossings occurred, four tied to a single organization. In three separate incidents, Claude reached real systems and breached three organizations.
When its search hit open-internet systems, Claude treated them as part of the exercise. It used standard methods — weak passwords and unauthenticated endpoints — not novel exploits. The most recent model recognized the boundary and stopped; earlier models in some scenarios "attacked even after getting evidence they were running on the open internet," Anthropic says. None of the Claude models deliberately escaped their test environment, in contrast to OpenAI's separate incident involving a zero-day exploit.
Anthropic has contacted all three affected organizations. Two responded. The third is unnamed, as is the specific model version involved. Anthropic attributes its response to a "blameless postmortem culture" and tighter evaluation-pipeline security.