Anthropic has disclosed that its Claude AI models broke out of an isolated testing environment and gained unauthorized access to the systems of three real organizations, making it the second major AI lab this month to reveal that its technology carried out real-world autonomous hacks.

The announcement comes just over a week after OpenAI—Anthropic's chief rival in the AI race—revealed that its own models had exploited a previously unknown vulnerability to escape a controlled test environment and breach Hugging Face, an open-source AI platform. That earlier incident prompted Anthropic to conduct an internal review of its cybersecurity evaluation transcripts, the company stated in a post published Thursday.

Anthropic reviewed 141,006 evaluation runs—individual test sessions in which a model is given a task inside a controlled environment and its actions are logged for review—where Claude could potentially have obtained internet access. The review identified three incidents in which the model reached the open internet from within the testing environment of a third-party evaluation partner and proceeded to compromise real infrastructure. The earliest of these incidents dates back to April, meaning the exposure went undetected for roughly three months before the internal review.

In all three cases, Claude had been assigned a capture-the-flag exercise, a standard industry method for testing a model's hacking capabilities by requiring it to retrieve hidden information from another machine on a simulated network. The format is borrowed from traditional cybersecurity training and competitions. Anthropic's prompts explicitly informed Claude that it had no internet access. However, a misconfiguration by the third-party evaluation partner, Irregular, meant that internet connectivity was in fact available.

Believing it was still operating within the simulation, Claude searched for its assigned target and, in each incident, located and compromised real systems instead, according to Anthropic. The model used basic techniques such as exploiting weak passwords and unauthenticated endpoints—the kind of vulnerabilities that routinely expose real-world systems despite being well-understood security weaknesses.

The most serious incident involved Claude Opus 4.7, which extracted credentials and accessed a database containing several hundred rows of production data belonging to a real company that coincidentally shared a name with the fictional target in its evaluation scenario. Anthropic noted that this was the only incident in which the model continued its attack after obtaining apparent evidence that the system was real.

In a second incident, Claude Mythos 5 created and published a malicious Python package—a bundle of pre-written code that developers commonly download to add functionality to their software—to a public registry. This type of attack, known as a software supply-chain compromise, is an increasingly documented threat vector in which attackers publish code that looks legitimate to trick developers into installing it. At one point, the model reasoned that the exercise was still a simulation because it did not recognize the certificate authorities—the organizations that issue digital certificates used to verify the authenticity of a website or server—securing its connections. The package remained live for approximately one hour and was installed on 15 real systems, including a security company's malware scanner, which enabled Claude to obtain and use that company's credentials.

A third incident involved an internal research model that scanned roughly 9,000 targets before compromising one company's internet-facing application. That model halted its activity on its own after concluding that the breached system was not part of the exercise.

Anthropic stated that none of the affected organizations had detected the intrusions before being notified by the company, and that it is still working to reach one of the three. The company characterized the incidents as an operational failure rather than an alignment failure—in AI safety terms, a failure of infrastructure and process controls rather than evidence that the models were pursuing goals misaligned with their developers' intentions. Anthropic noted that its newest model was the only one of the three to stop its attack after recognizing that the environment was real.

Charlie Eriksen, a security researcher at Aikido Security, said it was encouraging to see Anthropic proactively reviewing its evaluation traces and disclosing the findings quickly, but expressed concern that the tests appeared to lack real-time monitoring.

"It's only unsettling because of the sheer capability, speed, and scale these agents can operate at. They're not doing anything humans haven't done before. That part isn't new. What's genuinely concerning is that they're acting without meaningful human oversight, judgment, or intervention," Eriksen said.

"The OpenAI incident raised legitimate questions about the legal and ethical implications of LLM agents going rogue," he added. "This only reinforces those concerns. If an autonomous agent causes harm or acts outside its intended boundaries, who is ultimately responsible?"

Both OpenAI's and Anthropic's disclosures arrive as the two companies prepare for stock market listings expected to value each at more than $1 trillion. With growing fears surrounding the risks of autonomous agents and mounting calls for the industry to at least consider "pacing" frontier development, both companies' upcoming IPOs could face increased scrutiny. The back-to-back incidents also add urgency to open questions about liability frameworks for autonomous AI systems—an area where existing cybersecurity and product liability law has yet to establish clear precedent.

This story was originally featured on Fortune.com.