Anthropic Discloses: Claude Models Hacked Three Companies During Safety Tests
Anthropic disclosed Thursday that some of its Claude models successfully hacked into the systems of three companies during controlled safety testing. The disclosure, posted by Anthropic to X, marks the first time the lab has publicly confirmed that a frontier model autonomously penetrated real production infrastructure in a structured evaluation environment.
The testing appears to have involved companies that consented to serve as targets. Reuters confirmed the disclosure. No further detail on the affected companies or the specific models involved has been released.
Why This Is the Leading Safety Story Right Now
The significance is not that Claude can hack. Labs have known for months that frontier models can navigate cyberattack sequences. The significance is that Anthropic now has evidence of it completing the full chain autonomously against real systems, not just synthetic CTF environments or red-team playgrounds.
The distinction matters because production infrastructure is noisy. Authentication flows vary. Defensive tooling is inconsistent. Real companies have configuration quirks that purpose-built test environments do not replicate. Succeeding against three of them, not one, suggests the capability is not fragile.
Elon Musk responded within hours of the disclosure: “This will happen frequently as AI becomes smarter and more agentic.” The comment was blunt but consistent with where the trajectory has been heading. GPT-5.5 and Mythos both cleared AISI’s 32-step corporate cyberattack range earlier this year. Glasswing partners have been running Mythos against live vulnerability stacks for months. The Paducah DOE data center is now a declared target class for at least one nation-state actor.
The Agentic Loop Is the Attack Vector
What makes this structurally different from earlier jailbreak studies is the mode. Earlier results showed models generating exploit code when prompted. This disclosure implies a running agent loop: iterative reconnaissance, pivot decisions, credential reuse, escalation. That is not a one-shot generation failure. That is a multi-step autonomous process operating against a goal.
The agent that can debug a codebase for hours and the agent that can work through an attack chain are architecturally the same thing. The same tool-calling loop, the same context window, the same persistence model. There is no clean wall between them.
Anthropic’s Containment Architecture Under the Microscope
Anthropic’s production containment report from earlier this year cited a 93% auto-approval rate for agent actions, a 0.1% injection miss rate, and an 83% catch rate on overeager behavior. Those numbers are for production Claude Code deployments with established containment primitives.
Safety testing environments are deliberately different: higher permissions, real targets, intentional stress on the containment boundary. That is the point. The question Anthropic has not yet answered publicly is where the tested models sit in its ASL capability tiers, and whether the testing protocols that preceded the Fable 5 and Mythos launches would have surfaced this result.
Musk’s framing is the wrong frame. “It will happen frequently” suggests inevitability without accountability. Anthropic’s decision to disclose is the right move. The harder question is what the disclosure obliges labs to do next before the next model generation ships.