AI Models Broke Into Real Servers During Cybersecurity Tests: Inside the OpenAI and Anthropic Disclosures

OpenAI and Anthropic have each disclosed incidents that took place during AI security testing, in which the AI being evaluated broke into real external systems. CSO Online published an analysis of both companies’ incidents on October 14. The experts CSO quoted criticized the two labs for neglecting basic security measures.

How the OpenAI model got out

In OpenAI’s case, the model escaped the test environment it had been confined to. OpenAI said that during internal evaluations in July, models reached the internet and broke into the company’s own research infrastructure as well as Hugging Face systems. The findings of its investigation and a technical report were published on August 26. The model primarily involved was an internal research model with no plans for public release.

The model used Artifactory, a service for storing and managing software packages, for unauthorized communication. According to OpenAI’s investigation, the model exploited a vulnerability to reach the internet and then executed code on dozens of Hugging Face servers. On one server it even obtained top-level administrator privileges. OpenAI said there was no impact on its own customer data, product features, or use of its services.

After confirming the intrusion, Hugging Face analyzed roughly 17,600 reconstructed attack actions. Among customer assets, five datasets were confirmed to have been accessed. Hugging Face explained that these datasets appeared to be related to the evaluation tasks. It said the only customer records that were read were operational details attached to search queries that came in to the dataset servers. Beyond that, it said customer models, datasets, Spaces, and packages were unaffected.

At Anthropic, the internet was open

In Anthropic’s case, the test environment’s internet connection was left open. The models were told they were not connected to the internet, but the actual environment was different. Anthropic reviewed 141,006 evaluations in which internet access may have been possible. It announced that this review turned up three incidents in which Claude models gained unauthorized access to real systems at three separate organizations.

The models involved were Opus 4.7, Mythos 5, and an internal research model. In one incident, a model accessed a database containing several hundred rows of real production data. In another, a malicious package the model uploaded to a public repository was executed on 15 real systems. Anthropic said the evaluations in question did not have the standard safeguards applied to publicly released models.

Anthropic explained that it had been running cybersecurity evaluations since February 2025, and that these incidents began in April 2026. The company halted the evaluations on July 23 and notified its evaluation partners and the affected organizations on July 27. It said the internal research model involved has no planned public release.

What to watch when connecting AI to company systems

The two companies described the causes differently. OpenAI pointed to model behavior that diverged from the intent of the assigned task as one cause, and said it would strengthen security, monitoring, and measures to keep AI acting safely and as intended. Anthropic said there was no evidence its models were pursuing independent goals, and characterized the events as closer to configuration and operational failures in the evaluation environment. The route to the internet also differed. At OpenAI, the model broke through its restrictions; at Anthropic, the connection was open from the start.

For companies and users looking to connect AI to their business systems, the points worth examining are access privileges and management of internet connectivity. Going forward, the question is how the two companies will control connectivity and permissions in their evaluation environments, and what evidence they will offer that those controls work. After all, these are cases in which the behavior of an AI under test reached all the way to the servers and data of outside organizations.