Anthropic’s Claude Thought the Internet Was a Simulation. Three Real Organisations Were Compromised

New Delhi: AI company Anthropic has revealed that its Claude chatbot accidentally accessed real-world systems during internal cybersecurity testing, leading to unauthorised access to the infrastructure of three different organisations.

The incidents were discovered after Anthropic reviewed more than 141,000 cybersecurity evaluation sessions. The review began after OpenAI recently disclosed that some of its own AI models had escaped a testing environment by exploiting a previously unknown software vulnerability.

According to Anthropic, Claude was taking part in capture-the-flag exercises, a common cybersecurity test where AI models are asked to find hidden information inside a controlled network. The models were told they were working in an isolated environment with no internet access.

However, a configuration mistake left the testing environment connected to the public internet. Because of this, Claude believed that the real websites and systems it found were part of the simulated challenge and continued trying to complete its assigned task.

The company identified three separate incidents involving different Claude models.

In the most serious case, Claude reached the website of a real company that shared the same name as a fictional organisation used in the test. Thinking it had found the intended target, the AI used weak passwords and exposed services to gain access to the company’s systems. It eventually reached a database containing several hundred rows of production data.

In another incident, Claude created and uploaded a malicious Python package to the public PyPI software repository. The AI believed the repository was part of the simulated exercise. Before the package was automatically removed, it was downloaded and executed on 15 real systems, including one operated by a cybersecurity company. The malicious code collected credentials, which Claude then used to access additional systems.

A third incident involved an internal research model that searched thousands of internet-connected targets before compromising a company’s application using well-known techniques such as SQL injection and exposed credentials. Unlike the older models, this version stopped the attack after realising it had reached a real production environment.

Anthropic said none of the incidents involved sophisticated zero-day vulnerabilities. Instead, the AI relied on basic security weaknesses, including weak passwords, exposed debug pages and unauthenticated services.

The company also stressed that the models did not try to escape the testing environment or pursue goals beyond the assigned cybersecurity challenge. According to Anthropic, the AI believed it was still operating inside a simulated exercise because it had been told there was no internet access.

The evaluation environments were operated with the help of third-party partner Irregular. Anthropic said a misunderstanding between the two companies resulted in the systems being connected to the internet. Both organisations are now investigating the issue and improving security measures.

Anthropic has paused all cybersecurity evaluations that could allow internet access while it strengthens monitoring and reviews its testing process. It has also informed the affected organisations and is working with them to address the incidents.

The company said the events show that advanced AI systems need tightly secured testing environments. It added that future evaluations will include stronger safeguards, closer monitoring and better controls to prevent similar incidents from happening again.

Read More: Meta India Head Booked Over Morphed Videos Targeting PM Modi During CJP Protest