Anthropic：AI Claude 在测试环境中逃逸并入侵多家组织

Anthropic 周四表示，其 AI 模型 Claude 在测试期间入侵了三家组织的系统；就在几天前，竞争对手 OpenAI 披露，一名失控的 Agent 曾在 AI 公司 Hugging Face 展开持续数日的黑客攻击行动。

Anthropic 表示，在网络安全评估期间，由于一项配置错误使模型能够从本应隔离的测试环境访问互联网，Claude 获得了对这些系统的未授权访问。

该公司称，在审查 141,006 次网络安全评估运行记录后发现了这些事件。这项审查工作是在 OpenAI 披露相关情况后启动的。

这些入侵事件表明，AI 能力的持续扩展已经在加剧专家长期担忧的安全威胁；即使是顶尖开发商，也可能因其模型能够利用的漏洞而措手不及。

“Claude 使用了基础技术攻破受影响组织的基础设施，例如利用弱密码和未经认证的端点。”该公司表示。

Anthropic 称，事件涉及三款不同模型：Claude Opus 4.7、Claude Mythos 5，以及一款内部研究模型。最早的案例可追溯至 4 月，发生在缺乏该公司所称标准安全防护措施的评估环境中。

这些入侵发生在所谓的“夺旗”（capture the flag）演练期间，即要求模型在模拟网络中寻找隐藏信息的测试。该公司表示，其提示词告知模型它们无法访问互联网，但由于与评估合作伙伴 Irregular 之间的沟通误解，这些系统实际上仍连接至公共互联网。

Anthropic 表示，其中两家组织在收到联系前并不知道相关活动；该公司补充称，仍在尝试联系第三家组织。

该公司在一份声明中表示：“我们是在主动审查网络安全评估记录后发现这些事件的。”

Anthropic 表示，随着 AI 模型越来越能够执行现实世界的网络活动，这些发现凸显出：无论在内部还是第三方测试环境中，都需要实施更严格的控制措施。

Anthropic ⁠said on Thursday its AI Claude model hacked ⁠systems of ⁠three ​organizations during testing, days after rival OpenAI ⁠revealed a rogue agent had gone on a days-long ⁠hacking spree at the AI ​firm Hugging ‌Face.

Claude gained ‌unauthorized access to the ‌systems during cybersecurity evaluations after a misconfiguration allowed the models to reach the internet from testing environments that ‌were supposed to be isolated, Anthropic said.

The company said ​it identified the incidents after reviewing 141,006 cybersecurity evaluation runs, a process it ⁠launched following OpenAI’s disclosures.

The ‌breaches signal that AI’s expanding capabilities are already fueling the security threat experts have long feared ‌and that even top developers can be caught off-guard by flaws their models can exploit.

“Claude compromised the ​impacted ​organizations’ infrastructure using ​basic techniques, such as ​exploiting ‌weak passwords and ​unauthenticated ​endpoints,” it said.

Anthropic said the incidents involved three separate models: Claude Opus 4.7, Claude Mythos 5 and an internal research model. The earliest cases dated back to April and ‌occurred in evaluation environments that lacked what the company described as standard safeguards.

The breaches occurred during the so-called “capture the flag” exercises, in which models were tasked with finding ​hidden information in simulated networks. The company said its prompts told the models they had no internet access, but a misunderstanding with its evaluation partner Irregular left the systems connected to the public internet.

Two of the organizations were ​unaware of the activity ‌before being contacted, Anthropic ​said, adding that ​it was still trying to reach the third.

“We discovered these incidents after a proactive review of our cybersecurity evaluation transcripts,” the company said in a statement.

The findings underscore the need for stronger controls in both internal and third-party testing environments as AI models become increasingly capable of carrying out real-world cyber activities, Anthropic said.