Anthropic reports fourth cybersecurity incident with early version of Claude

Sept 9 — Anthropic on Wednesday identified a fourth cybersecurity incident involving an early version of ​its Claude AI model, a month after disclosing that the chatbot had hacked into the systems of three companies during testing.

The ‌company said in a blog post the incident occurred in January and involved an early version ⁠of Claude Opus 4.6. It has ​notified all the affected parties ⁠but did not disclose more details.

The disclosure follows Anthropic's announcement in July ‌that some of its ‌Claude models had hacked into the systems of three companies ⁠during cybersecurity tests.

The incidents stemmed from a ⁠mistake that inadvertently gave the models access to the open internet.

The company had identified the incidents after reviewing 141,006 test sessions, a process it launched after an autonomous agent powered by OpenAI's AI models triggered a hack that compromised the infrastructure of AI startup Hugging ‌Face.

Anthropic said on Wednesday it had missed a ​set of test sessions during the initial review, which were identified last month and led to the discovery of the fourth incident.

The company has engaged independent research firm METR to investigate the incidents. It said METR would be granted broad access, including to transcripts outside the period in which the incidents occurred and to employees, who would be ​permitted to share confidential information.

The initial agreement runs for eight weeks and can ‌be extended by ‌mutual consent, ⁠Anthropic said.

AI companies are under scrutiny over AI breakout events, including cases where AI agents have inadvertently been unleashed on to the open internet.

Over the past week, Reuters reported that rogue agents from OpenAI hijacked a German-language ‌wiki and a host ​of other sites — an incident OpenAI chose ‌not to disclose until ⁠the news ​agency made it public.

(Reporting by Mariam Sunny in Bengaluru; Editing by Tasim Zahid and ​Arun Koyyur)

Related topics