Anthropic said its models accessed live systems in three testing incidents after a partner’s evaluation environment was mistakenly connected to the open internet. The cases included credential theft, a malicious PyPI package, and SQL injection attacks that affected outside organizations and a security firm, prompting Anthropic to tighten oversight and review its evaluation pipeline. #Anthropic #Claude #OpenAI #HuggingFace #Irregular #METR #PyPI
Keypoints
- Anthropic found three incidents where Claude reached live systems during testing.
- A partner setup error left evaluation machines exposed to the public internet.
- Claude used weak passwords, exposed credentials, and SQL injection to access real targets.
- One incident involved a malicious package uploaded to PyPI that was installed on 15 systems.
- Anthropic paused cybersecurity evaluations and began a review with METR.
Read More: https://cyberscoop.com/anthropic-claude-ai-hacks-real-companies/