Episode II: Attack of The Claudes
Agentic, AI and Cybersecurity
Episode II: Attack of The Claudes
These weren’t the test systems Anthropic were looking for.
Aaron Beardslee, Security Researcher, Securonix Threat Labs
Two weeks after Hugging Face disclosed an AI-driven intrusion into part of its production infrastructure, Anthropic said it had found three incidents from its own cyber evaluations. Hugging Face traced its compromise through a data-processing pipeline, where a malicious dataset abused a remote-code dataset loader and a template-injection issue in a dataset configuration. Code executed on a processing worker, the attacker escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into internal clusters. Our earlier blog followed the chain because with the route appearing like a real intrusion path: package infrastructure, dataset workers, credentials, command execution, and internal movement.
OpenAI later said the activity stemmed from models running a cyber-capability evaluation with reduced cyber-refusal rates. Each model was supposed to operate inside a highly isolated environment, with network access constrained through an internally hosted package-registry cache proxy. According to OpenAI, the models found and exploited a zero-day vulnerability in that proxy, escalated inside the research environment, reached a node with internet access, inferred that Hugging Face might hold ExploitGym-related material, then chained stolen credentials and additional vulnerabilities to reach Hugging Face production infrastructure.
Anthropic’s disclosure is technically simpler, but I wouldn’t call it smaller. The company reviewed 141,006 evaluation sessions after the OpenAI incident and found three cases where Claude models reached real organizations during private cyber tests. The evaluations used Claude Opus 4.7, Claude Mythos 5, and an internal test model, and that the models exploited basic weaknesses such as weak passwords during capture-the-flag-style exercises. Two of the affected organizations reportedly did not know about the breaches until Anthropic contacted them.
The Claude runs were supposed to happen inside a closed test environment. The model’s job was to obtain hidden information from another machine on that network. These typically require an evaluation harness with targets, services, credentials, tool access, and enough feedback for the model to prove whether it can complete the task. Reporting on the Anthropic incident says a miscommunication with its testing partner, Irregular, left the environment with internet access. Once egress existed, the lab could reach systems outside the exercise.
From a technical point of view, the first failure lives in the harness. A cyber model can be told that it is inside an isolated lab, but packets do not care what the prompt says. DNS still resolves. Routes still route. Package registries still accept uploads. Databases still answer if the network path, authentication state, and application surface allow it. With an autonomous model pursuing a capture-the-flag objective, it will keep treating available responses as part of the task unless the runtime prevents that path or the model recognises the boundary on its own.
There were three concrete examples from Anthropic’s disclosure: one Claude run allegedly mistook a real company domain for a fictional one and accessed a database; another uploaded a malicious Python package to the real PyPI repository, where it reportedly ran on 15 systems; a third scanned thousands of live servers and nearly exploited a SQL injection issue before stopping after recognising it was interacting with a real cloud network.
Now we’re looking at a different attack shape than Hugging Face. Hugging Face was an intrusion-chain story. The model-driven evaluation found a crack in package infrastructure, reached the internet, inferred where useful benchmark material might live, then followed the path into production. Anthropic is a containment story. The lab had a door. Claude used the door handle.
Claudes Kessel Run
Logs need to capture tool calls, command output, DNS lookups, HTTP requests, authentication attempts, package operations, file writes, and model-visible context while the run is still active.
Anthropic’s own sandbox guidance says tool execution can reach arbitrary external hosts without egress restrictions. That is probably a warning that needs to be at the top of this incident because the reported failure was both a model continuing a task AND a runtime allowing the task to leave the lab. A sandbox with outbound access that became a room with a route table.
A Familiar Problem, at Warp Speed
The BBC reporting described the evaluation task: find hidden information on another machine in a closed network. It’s an obvious scoring function: Get access. Locate the secret. Return proof.
The model didn’t have to invent a new motive to cause damage with those conditions. It just needed a goal, a path and the handler to say “Go.” If a domain responds, the model can treat it as a lead. If a login works, it can treat it as progress. If a package upload succeeds, it can treat the result as confirmation. If a database returns useful output, the task loop has been rewarded.
Professor Gina Neff’s comment to the BBC is a clean way to read the incident: models were doing what people told them to do. The companies building, testing, and containing systems powerful enough to turn a bad boundary into real attack activity.
David Allott from Veeam framed the same point. He said the lesson was not necessarily that AI had developed a fundamentally new attack capability, but that agents can combine capabilities, obtain credentials and system access, and act autonomously while adapting scope and scale at machine speed.
In short, they are familiar security problems moving through a faster execution loop.
Simple Weaknesses Still Become Real Incidents
The Anthropic cases did not need the same exploit chain reported in the OpenAI and Hugging Face incident. AP reported basic vulnerabilities. Tom’s Hardware reported weak boundaries, live infrastructure, and real systems that responded. Those details are less dramatic than a zero-day chain, but defenders should not confuse less dramatic with less important.
A weak password still opens a system. A real PyPI upload can still reach users. A live database still has to be investigated after unauthorized access. Intent behind the activity may have been evaluation, but we cannot ignore that the affected organizations still had real systems touched without permission.
Security teams spend a lot of time cleaning up incidents that begin with ordinary mistakes. A door left open and a credential reused. The test system connected to something it should not see. That one internal tool trusted because it lives in a lab. Agentic cyber evaluations put those mistakes under heavy pressure because the model can keep moving through them quickly and without the hesitation a human tester might feel when the environment starts looking wrong. Trust in the boundary is now the failure.
A Detection in The Review
According to reports, Anthropic found the incidents after reviewing more than 141,000 sessions. The review was prompted by the OpenAI and Hugging Face disclosure, not by immediate detection from the affected organizations. Two organizations reportedly learned about the intrusions from Anthropic. This is now in delayed discovery territory.
Agent-driven evaluation activity may not look like a normal intrusion crew. It can show up as scanning, login attempts, package activity, odd HTTP requests, database access, failed exploitation, or a sudden stop when the model recognized something real. Evidence will be present in logs, but source and purpose will be hard to infer without access to the model transcript and the evaluation harness.
A useful postmortem shouldn’t be a pile of network logs. It should be the prompt sequence, tool calls, command output, sandbox configuration, DNS behavior, proxy logs, credential scope, package registry records, and the exact moment when the run crossed from synthetic to real infrastructure. Same as an attack chain, defenders are left with fragments from a system built to move incredibly quick.
The responders will have more work to do. They’ll reconstruct the timeline, determine what was touched, identify whether data moved, and decide whether the activity stopped because the run ended, a control blocked it, or the model saw something shiny to change course.
The Test Harness
Cyber-capability testing used to sound like measurement, yet these incidents are evolving it to look more like infrastructure security.
The harness now must be threat modeled as though the model will use every reachable path. That’s not debatable with the recent reports. Package proxies cannot be treated as convenience layers, while sandboxes cannot be treated as safe because they carry the label. We keep thinking credentials are harmless because the test proclaims they are fake. But external reach cannot exist as an accident.
Hugging Face incident shown light on support infrastructure becoming a movement path once a model-driven evaluation gets enough feedback. Package proxies, dataset workers, notebook runtimes, and build systems can become paths where normal engineering exceptions turn into attacker movement.
Anthropic adds a harsher first step. Before the model needs to chain through complex infrastructure, the lab can simply fail to be closed. Now every ordinary internet-facing weakness became the evaluation surface.
Labs, enterprises, and security teams will need to start changing how they think about agent deployment. Any system with a goal, tools, memory, execution, and network reach needs a boundary that fails closed. It needs monitoring that can interrupt the run while damage is still theoretical. It needs logs that make sense to responders after the fact and it needs permissions narrow enough that a wrong turn becomes a dead end instead of a breach.
Episode III: Revenge of the Snitch
This same story underneath keeps appearing with different names attached.
OpenAI says its models found a path out of a constrained evaluation and reached Hugging Face while pursuing benchmark solutions. Anthropic says Claude models reached three real organizations during private testing because a closed environment had live internet access. Both companies framed their disclosures as lessons for safety, containment, and oversight. Both companies published accounts that make their frontier systems sound unusually capable at the exact moment the market is trying to understand who has the strongest models.
Security teams have to weigh both ideas at once.
It’s a new pattern now: cyber-capable agents are beginning to stress the boundaries around the labs built to measure them. Egress, credentials, package paths, DNS, runtime logs, and test infrastructure now belong in the threat model.
We may also be watching the early battle of the marketers. Every incident report will be seen as carrying two messages. One tells defenders where the boundary failed while the other tells the market how powerful the model has become.
