Claude models accessed real third-party systems during misconfigured cyber evaluations
Anthropic found that Claude models in capture-the-flag evaluations, told they had no internet access, reached it through a partner's misconfigured setup and attacked real systems. Claude Opus 4.7 took credentials and got into a database with several hundred rows of production data at a company whose domain matched the fictional target. An internal model used an exposed debug page and SQL injection on another firm. An early Opus 4.6 got admin access to a third party's machine in January 2026.
Sources
- Primary: https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents
- Upstream: Editorial
- Entered by the cybermap.lol editors, with sources on the entry
Defenses for this class of incident
all categoriesAn AI-era incident sits in these classes of the AI-security landscape. The companies below work on that class of problem. This is a taxonomy, not a claim that any of them would have changed this incident.
Vendor data: AI Security Startups Map by Prompt Security (CC BY 4.0), synced daily. startups.prompt.security. Paid placements are labelled Sponsored; HeimWall, which runs this site, is labelled Operator. 453 companies in the directory.
Wrong or missing? Email founders@heimwall.ai. Corrections are logged here, in place. How corrections and takedowns work.