Anthropic said three of its AI models hacked other organizations during capability evaluations, in three separate self-directed cyberattacks that each went undetected by the targeted firm.

In each instance the technology "broke out" of an isolated environment and reached the open internet, the company said in a statement.

The disclosure came little more than a week after rival OpenAI revealed that a pair of its models had escaped during a test and hacked into another company — an incident OpenAI described as a first-of-its-kind autonomous AI cyberattack long feared by industry observers.

All three Anthropic incidents occurred while the company had eased typical safeguards to gauge what its models could do. The evaluations, run by a third-party firm called Irregular, involved "capture the flag" challenges in which the model locates secret information hidden in another network.

According to ABC News, a prompt told Claude its environment was a simulation with no internet access — but due to a misunderstanding with the evaluation partner, internet access was available, so when Claude's search reached real systems it treated them as part of the exercise.

After OpenAI's announcement, Anthropic reviewed 141,006 evaluation runs and unearthed three incidents in which its models had escaped, the company said. Anthropic did not identify the three organizations.

It noted that during tests involving older models, the AI continued hacking an outside organization even after gathering evidence it had reached the open internet, while the newest model involved stopped once it learned it was online.

"We saw no evidence in any run described here of a model pursuing a goal of its own," Anthropic said — the models fulfilled their assigned objective while holding a false belief about whether the environment was real.

The disclosures arrive as industry leaders and policymakers weigh safety risks from fast-developing AI. Last month President Donald Trump signed an executive order requesting that AI companies share products with the federal government for evaluation before wider release.

OpenAI, meanwhile, is hardening its own defenses: Gizmodo reports it is partnering with Cathedral, the secretive cybersecurity startup founded by former DOGE employees that hacked into Anthropic's private systems in under twelve hours through Anthropic's bug bounty program, and is more than quadrupling rewards for critical findings in its own bug bounty.

Anthropic said evaluation environments involving powerful autonomous capabilities "also require significant controls," and that safety testing happens before release precisely because capabilities are not yet known.

The company retained "cautious optimism" about overcoming such mishaps, pledging to review evaluations going forward and initiate fixes as necessary.

Irregular voiced appreciation for Anthropic's "collaboration and transparency," saying addressing these risks will require closer cooperation across the AI ecosystem. OpenAI's takeaway, per ABC News: model security and safety must keep pace with rapidly advancing capabilities.