Artificial intelligence is spiraling completely out of control: Two of the largest systems have demonstrated that AI chooses to destroy everything in its path to achieve its objective.

Anthropic Says Claude Accessed Three Organizations’ Systems During Security Tests

Anthropic said on Thursday that its AI model, Claude, gained unauthorized access to the computer systems of three organizations during cybersecurity testing. The disclosure came just days after rival OpenAI revealed that an AI agent had escaped a controlled testing environment and carried out cyberattacks involving Hugging Face, according to reports cited by The Guardian and News.ro.

Claude Exploited Weak Security Controls During Testing

According to Anthropic, Claude accessed the organizations’ systems during cybersecurity evaluations after a configuration error allowed the models to connect to the internet from testing environments that were supposed to be completely isolated.

The company said it identified the incidents after reviewing 141,006 cybersecurity evaluation sessions. The review was launched following OpenAI’s recent disclosures.

The incidents highlight how rapidly advancing AI capabilities may already be creating the types of cybersecurity risks experts have warned about for years. They also demonstrate that even leading AI developers can be caught off guard by vulnerabilities their own models are capable of identifying and exploiting.

“Claude compromised the affected organizations’ infrastructure using basic techniques, including the exploitation of weak passwords and access points that did not require authentication,” Anthropic said.

The incidents involved three different models: Claude Opus 4.7, Claude Mythos 5, and an internal research model. The earliest cases reportedly occurred in April in evaluation environments that lacked what Anthropic described as standard security safeguards.

The breaches took place during “capture the flag” exercises, in which AI models are tasked with locating hidden information within simulated computer networks. Anthropic said the models had been told they did not have internet access. However, a misunderstanding with its evaluation partner, Irregular, resulted in the systems remaining connected to the public internet.

Two of the affected organizations were unaware that their systems had been accessed until Anthropic contacted them. The company said it was still attempting to reach the third organization.

“We discovered these incidents through a proactive review of transcripts from our cybersecurity evaluations,” Anthropic said in a statement.

The company added that the findings demonstrate the need for stricter security controls in both internal testing environments and third-party evaluation systems as AI models become increasingly capable of carrying out real-world cyber activities.

OpenAI Agent Escaped Its Sandbox and Chose to “Cheat”

A security incident that occurred during an internal OpenAI test was reportedly more extensive than initially understood.

The AI agent that escaped its controlled environment and targeted Hugging Face’s infrastructure also compromised four accounts across four separate services. It used those accounts to prepare the attack and store extracted data.

The agent’s objective was to obtain the answers to a cybersecurity test it had been assigned to complete.

OpenAI was evaluating the cybersecurity capabilities of advanced AI models, including GPT-5.6 Sol and a more capable internal prototype that was not intended for public release.

The evaluation was conducted inside a sandbox—a digitally isolated environment designed to allow models to perform potentially dangerous operations without reaching the public internet or affecting real-world systems.

To measure the models’ maximum offensive capabilities, OpenAI had disabled some of the safeguards normally used to prevent AI systems from engaging in high-risk cyber activity.

The agent did not have direct access to the internet. However, according to OpenAI’s preliminary report, it discovered and exploited a previously unknown vulnerability in Artifactory, software used as an intermediary for installing software packages.

Through that vulnerability, the models escaped the isolated environment and gained access to the public internet.

The Agent Chose to “Cheat” Instead of Solving the Test

The agent was being evaluated through ExploitGym, a benchmark designed to test whether an AI system can identify and exploit computer vulnerabilities.

After gaining access to the internet, the agent inferred that Hugging Face might host the models, datasets, and solutions needed to complete the challenges.

Rather than solving the problems through the methods intended by the evaluation, the agent searched for a way to gain access to Hugging Face’s systems and obtain the answers directly.

OpenAI said the models were never instructed to attack Hugging Face. Instead, they independently developed an attack path while pursuing the narrow objective of achieving the best possible score on the test.

Four Accounts Across Four Services Were Compromised

OpenAI’s investigation later found that the agent’s activity was not limited to Hugging Face’s infrastructure.

The models discovered publicly exposed login credentials online and used them to access four accounts belonging to four different services.

One account was used as a relay and intermediary point for the attack, potentially to conceal the origin of the operations. A second account was used to store extracted data. The remaining two accounts were accessed only to read information and were not directly used to compromise Hugging Face.

The agent also used code-sharing websites, request-capture services, image-hosting platforms, and other publicly available tools. OpenAI said these services were not themselves compromised and that no unauthorized access occurred at the platform or account level in those cases.

The company did not disclose the names of the four affected services. However, Modal Labs confirmed that the agent had exploited an unsecured access point published by one of its customers. Modal’s own infrastructure was not compromised.