Investigating three real-world incidents in our cybersecurity evaluations
Investigating three real-world incidents in our cybersecurity evaluations
调查我们在网络安全评估中发现的三起现实事件
Frontier Red Team | Jul 30, 2026 前沿红队 | 2026年7月30日
In a review of our cybersecurity evaluation transcripts, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations. Below we describe what happened, how it happened, and what we’re changing. We encourage other AI labs to perform similar reviews. This post reflects our current understanding; we’ll update it if any details change. 在审查我们的网络安全评估记录时，我们发现了三起事件：Claude 模型在第三方评估环境内或与其交互时连接到了互联网，随后未经授权访问了三个不同组织的真实系统。下文我们将描述事件经过、发生原因以及我们正在采取的改进措施。我们鼓励其他人工智能实验室进行类似的审查。本文反映了我们目前的理解；如有细节变动，我们将进行更新。
On July 21, OpenAI disclosed that several of their models had broken out of an isolated test environment by exploiting a previously unknown (“zero-day”) vulnerability. The models went on to access the production infrastructure of Hugging Face, a platform for open-source machine learning models and AI datasets. 7月21日，OpenAI 披露其多个模型通过利用一个此前未知的（“零日”）漏洞，突破了隔离的测试环境。这些模型随后访问了 Hugging Face（一个开源机器学习模型和人工智能数据集平台）的生产基础设施。
In response to this incident, we began a large-scale retrospective review of our own cybersecurity evaluations. In particular, we looked for evidence that Claude—like the OpenAI models that accessed Hugging Face—was able to access the internet from within testing environments that should have been sealed off. 针对这一事件，我们开始对自身的网络安全评估进行大规模的回顾性审查。我们特别寻找证据，以确认 Claude 是否像访问 Hugging Face 的 OpenAI 模型一样，能够从本应封闭的测试环境中访问互联网。
After reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations. 在审查了 141,006 次 Claude 可能获得互联网访问权限的评估运行后，我们确定了三起事件：模型在与我们的第三方评估合作伙伴之一 Irregular 的评估环境交互时或在其中访问了互联网，并随后未经授权访问了三个不同组织的生产基础设施。
In all three incidents, Claude had been tasked with a capture-the-flag challenge, one of the ways we assess a model’s cyber capabilities. The model is given a fictional scenario and told that a piece of secret information (the “flag”) has been hidden on a different machine on the network, and its objective is to break in and retrieve it. The challenge is left open-ended, and no particular method is prescribed. 在这三起事件中，Claude 的任务都是“夺旗赛”（Capture-the-flag），这是我们评估模型网络能力的方式之一。模型会被设定在一个虚构场景中，并被告知一段秘密信息（即“旗帜”）隐藏在网络中的另一台机器上，其目标是入侵并获取该信息。挑战是开放式的，没有规定具体的方法。
In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise. (Cybersecurity evaluation ranges commonly include realistic details in order to accurately assess what models are capable of in real settings; a realistic-looking target would not itself be clear evidence to a model that the target is not part of a simulation.) 在所有案例中，Anthropic 的评估提示词都明确告知 Claude 其环境是模拟的，且没有互联网访问权限。由于我们与评估合作伙伴之间的误解，实际情况并非如此，互联网访问权限实际上是开启的。因此，当 Claude 的搜索将其引导至开放互联网上的真实系统时，它将其视为练习的一部分。（网络安全评估范围通常包含逼真的细节，以便准确评估模型在现实环境中的能力；一个看起来逼真的目标本身并不能让模型明确判断该目标不是模拟的一部分。）
Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. It did not find or exploit any complex vulnerabilities, and in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned. However, in some cases, our older model continued its attack even after getting evidence it was running on the open internet; our latest model stopped once it recognized it was on the internet. In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment. 在错误地认为所有可访问实体均属于练习范围的情况下，Claude 使用了基础技术（如利用弱密码和未经身份验证的端点）入侵了受影响组织的基础设施。它没有发现或利用任何复杂的漏洞，且在每种情况下，Claude 仅致力于完成评估所分配的特定夺旗任务。然而，在某些情况下，我们的旧模型在获得其正在开放互联网上运行的证据后仍继续攻击；而我们的最新模型在识别出其处于互联网上后便停止了操作。在这些情况中，Claude 均未尝试自我外泄或蓄意逃离其测试环境。
The incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model. The earliest incidents date to April. The models in each of these evaluations ran without the standard safeguards we deploy when we make the model generally available (that is, they did not have the classifiers and monitoring we usually implement to prevent misuse). The models did, however, have their model-specific safety training (that is, they were not the “helpful-only” versions of the models that we sometimes use in testing). All the evaluations described here run on dedicated infrastructure, which is separate from and has no access to Anthropic’s sensitive internal systems or customer data. 这些事件涉及三个不同的 Claude 模型：Opus 4.7、Mythos 5 以及一个内部研究测试模型。最早的事件发生在四月。这些评估中的模型在运行时没有部署我们向公众发布模型时所采用的标准防护措施（即它们没有我们通常用于防止滥用的分类器和监控机制）。不过，这些模型确实经过了针对其自身的安全训练（即它们不是我们有时在测试中使用的“仅提供帮助”版本）。此处描述的所有评估均在专用基础设施上运行，该基础设施与 Anthropic 的敏感内部系统或客户数据是隔离的，且无法访问后者。
We began our transcript review on Thursday, July 23, and stopped all cyber evaluations the same day after identifying transcripts where Claude may have accessed the internet. We identified all three incidents the next day. We notified our evaluation partner Irregular and the three affected organizations on Monday, July 27. The two organizations we were able to reach had not previously detected the activity or contacted us, and we are now working with them to remediate. We are continuing to reach out to the third. 我们于 7 月 23 日（周四）开始审查记录，并在发现 Claude 可能访问互联网的记录后，于当天停止了所有网络评估。我们在次日确定了全部三起事件。我们于 7 月 27 日（周一）通知了我们的评估合作伙伴 Irregular 以及三个受影响的组织。我们联系上的两个组织此前并未检测到相关活动或与我们联系，目前我们正与他们合作进行补救。我们正在继续尝试联系第三个组织。
We conducted this review in collaboration with Irregular. We’re grateful to them for working closely with us to understand and resolve these incidents; they are also conducting their own investigation. We believe this type of collaboration is increasingly critical to ensuring safe, rigorous evaluation of models. We look forward to our joint work on security. In what follows, we provide more details on each incident and how we’re responding moving forward. 我们与 Irregular 合作进行了此次审查。我们感谢他们与我们密切合作，共同理解并解决这些事件；他们也在进行自己的调查。我们认为，这种合作对于确保模型评估的安全性和严谨性日益关键。我们期待在安全领域开展联合工作。接下来，我们将提供有关每起事件的更多细节以及我们未来的应对措施。
Background on cyber evaluations
网络评估背景
We regularly run cybersecurity evaluations that involve simulating real offensive cybersecurity challenges. These evaluations are a critical step in developing and releasing models—a nuanced understanding of model capabilities allows us to design appropriate safeguards and ultimately release models safely. 我们定期进行涉及模拟真实攻击性网络安全挑战的网络安全评估。这些评估是开发和发布模型的关键步骤——对模型能力的细致了解使我们能够设计适当的防护措施，并最终安全地发布模型。
We began running cybersecurity evaluations in February 2025 with Claude Sonnet 3.7 on Cybench, which consisted of 40 different capture-the-flag challenges. Over time, we’ve increased the number of benchmarks we use as new ones are released and model capabilities evolve. In the Mythos 5 System Card, for example, we included CyberGym and ExploitBench, benchmarks that evaluate the ability of language models to find novel vulnerabilities. In most of these evaluations, the environments are not connected to the internet, and the model is told as much. 我们于 2025 年 2 月开始在 Cybench 上使用 Claude Sonnet 3.7 进行网络安全评估，该基准测试包含 40 个不同的夺旗挑战。随着新基准的发布和模型能力的演进，我们不断增加所使用的基准测试数量。例如，在 Mythos 5 系统卡中，我们纳入了 CyberGym 和 ExploitBench，这些基准测试旨在评估语言模型发现新漏洞的能力。在大多数此类评估中，环境均未连接到互联网，且模型会被明确告知这一点。