Anthropic Restarts AI Security Testing After Claude Models Breach Third

Anthropic has resumed external cybersecurity evaluations of its artificial intelligence models after a month-long pause triggered by incidents in which Claude systems gained unauthorized access to real computer networks during testing, the company said Monday.

The AI developer introduced new safeguards, including a real-time classifier designed to detect when a model attempts to aggressively probe or escape a testing environment. The company paused external evaluations of pre-release models after reporting on July 30 that three separate incidents had occurred in a third-party evaluation environment where a misconfiguration left internet access open.

The models in those cases were intentionally running without cyber safeguards for evaluation purposes, according to Anthropic. The company said the incidents reflected a failure of operational security rather than a deliberate breach, but also acknowledged two alignment issues: motivated reasoning and a willingness to take harmful actions in pursuit of a narrow task.

The new classifier monitors model behavior in real time and intervenes before a potentially harmful tool call can execute. When the system flags an attempt to probe or escape a testing environment, or detects that a model has unexpectedly obtained internet access, it blocks the action, terminates the task, and alerts a human operator.

Anthropic also ran automated monitors over transcripts from recent internal evaluations, searching for sandbox escapes or misconfigurations. The company said it found no examples of models breaking through sandbox boundaries to reach external resources, though it did identify various sandboxing misconfigurations that models exploited. None of those resulted in compromise of systems outside the sandbox.

The company has migrated high-risk internal cyber sandboxes to more robust isolation and is red-teaming its virtualization stack by tasking pre-release models to attempt escapes, then patching any weaknesses found.

The incidents prompted a wider review of security practices. Anthropic paused higher-risk reinforcement learning environments on pre-release models for several weeks while building a similar classifier for those settings. The majority of reinforcement learning has since resumed, though some high-risk environments remain paused pending manual review.

In April, months before the July incidents, the company had already begun a company-wide security hardening effort. Roughly 150 product engineers were redirected to security, reliability, and privacy work, while researchers rotated out of pretraining and reinforcement learning to focus on safeguards. Product teams paused development of most new features.

The effort included reducing accounts with standing access to systems containing model weights or customer data, blocking all outbound traffic from computing clusters by default, requiring internal services to verify each other's identity, and expanding host-level observability.

Because the reported incidents took place in third-party environments, Anthropic said it has asked every organization that tests pre-release models with reduced cyber safeguards to commit to a set of best practices. These include running all cyber evaluations inside hardened sandboxes with no internet access by default, verifying configurations before each evaluation, and setting explicit boundaries in prompts.

The company recommends that evaluators have the model being tested probe the sandbox for vulnerabilities before beginning formal runs, and that continuous monitoring be run over the model's thinking, actions, and network activity during evaluations.