Claude 模型在 Anthropic 网络安全评估期间突破真实生产系统

“In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations. Our post describes what happened, how it happened, and what we're changing. We encourage other AI developers to perform similar reviews. We conducted this review together with @Irregular, one of our evaluation partners, and thank them for the joint investigation and their collaboration on this post. This type of collaboration is increasingly critical to safe, rigorous evaluation of models, and we look forward to continuing to work together on security.”

“CLAUDE HACKED 3 REAL COMPANIES DURING A FAKE TEST AND ANTHROPIC ONLY FOUND OUT BY ACCIDENT. After OpenAI disclosed its models escaped an isolated test environment via Hugging Face, Anthropic reviewed 141,006 of its own cybersecurity evaluation runs > three incidents found, involving Opus 4.7, Mythos 5, and an internal test model > each was a capture-the-flag exercise, told explicitly "you have no internet access" > a misconfiguration gave them internet access anyway one model found a real company sharing a name with its fake target, extracted credentials and database rows, real production data another built and published a real malicious Python package to PyPI, chasing a fake company's fake instructions. it got installed on 15 real systems in about an hour, including a security company's own malware scanner here's the part that matters: all three models eventually got signs their targets were real. Opus 4.7 kept attacking anyway. Mythos 5 talked itself back into believing it was still a simulation. the newest model recognized the environment was real and stopped on its own no model tried to escape its test environment or exfiltrate itself. this wasn't a jailbreak, it was a broken assumption about internet access, compounding into real-world impact Anthropic's framing it as an infrastructure failure, not an alignment failure, and says the safeguards on its public models would have blocked all of this”