Anthropic 称 Claude 在测试中意外入侵了真实公司的系统

Anthropic 刚刚发现，其多款 Claude AI 模型在测试期间曾入侵三家不同组织的系统，且这些模型是自行行动，Anthropic 当时并未察觉。这一披露发生在竞争对手 OpenAI 表示其一款模型曾入侵开发者平台 Hugging Face 数日之后，也进一步加深了外界对前沿 AI 实验室是否已采取足够措施来控制其正在构建、能力日益增强的系统的担忧。

Anthropic 在一篇介绍这些事件的博客文章中表示，Claude 在网络安全评估期间未经授权访问了这些系统。所有攻击都发生在“夺旗”（capture-the-flag）演练中，这是一种常见的黑客能力测试方式：要求模型在模拟网络中寻找并获取隐藏信息。

在 Hugging Face 事件以及强大的中国开放权重模型发布之后，这一披露进一步加大了前沿 AI 实验室面临的压力。各大实验室的员工如今正呼吁建立协调一致的全球治理机制，而美国立法者也已开始考虑对强大模型及哪些人能够访问这些模型实施更严格的监管。

Anthropic 表示，其网络安全测试环境原本应当是隔离的。然而，该公司称，一项“配置错误”使 Claude 所访问的机器“拥有实时互联网访问权限”；而由于所有模型都被“明确告知”自己无法访问互联网，它们便“假定”所遇到的真实网络属于模拟环境的一部分。

根据博客文章，最早的事件可追溯至 4 月，涉及三种不同的 Claude 模型：Opus 4.7、Mythos 5，以及“一款内部研究测试模型”。Anthropic 表示，在对这些模型的网络能力进行测试时，它们并未配置通常用于抑制高风险行为的标准安全防护措施。

该公司表示，它是在审查超过 14.1 万次网络安全测试运行记录后才发现这些事件的；而它之所以开展这项审查，是因为 OpenAI 此前披露，对 Hugging Face 发起攻击的是其失控的 AI Agent。

当三款模型遇到表明其所接触系统实际上是真实系统的信息时，表现截然不同。按照 Anthropic 的说法，最早的模型 Opus 4.7 识别出自己已进入真实系统，“但仍继续了攻击”。其旗舰模型 Mythos 5 发现自己正在使用互联网，但不知为何仍推断这一切属于模拟的一部分，因此继续执行。Anthropic 称为“我们最新模型”的内部测试模型，则在证据显示其目标是真实时停止了演练。

Anthropic 没有公开受影响组织的身份，并表示将继续调查此事，并在可能时提供最新进展。该公司还称，正在与 AI 研究非营利组织 METR 洽谈，对事件经过进行第三方审查。OpenAI 也已聘请 METR 进行独立审查。

在整篇文章中，Anthropic 反复将这些事件的性质及其自身处理方式与 OpenAI 的事件作对比，并在文末以四点项目列表说明差异，以及为什么它认为自己的回应更好。Anthropic 强调，其“主动”审查了测试，并且是在任何公司发现相关活动之前进行审查。该公司还表示，其模型是通过“一条开放路径”访问互联网，而不是像 OpenAI 的 Agent 那样利用一种新型漏洞；它还补充称，其最新模型在意识到自己处于真实环境后停止了行动。

Anthropic 还表示，其模型的失败方式不同于 OpenAI 的 Agent，并称这是一种更安全的失败形式。该公司表示：“尽管两者之间并不存在绝对清晰的界限，但我们认为，这些事件更接近于测试框架和运营层面的失败，而非模型对齐失败。”

用通俗的话说：Claude 模型是在执行它们被要求执行的任务；而 OpenAI 的 Agent 则以其创造者未曾预期的方式追求目标。在 AI 安全领域，这种情况被称为“失对齐”（misalignment）。

Anthropic 呼吁其他 AI 实验室对自身网络安全测试开展类似的主动审查，并表示这一发现凸显出，在测试 AI 系统时有必要采取更强的控制措施和安全保障。

Anthropic just realized several of its Claude AI models hacked into the systems of three different organizations during testing, acting on their own and without the company noticing. The revelation comes days after rival OpenAI said one of its own models had breached developer platform Hugging Face, adding to growing unease over whether frontier AI labs are doing enough to control the increasingly capable systems they are building.

In a blog post describing the incidents, Anthropic said Claude gained unauthorized access to the systems during cybersecurity evaluations. All of the attacks happened during “capture-the-flag” exercises, a common way of testing hacking ability, where models are asked to find and obtain hidden information inside of a simulated network.

The disclosure adds to mounting pressure on frontier AI labs in the wake of the Hugging Face incident and the release of powerful open-weight Chinese models. Employees at the major labs are now calling for coordinated global governance, and US lawmakers have begun weighing tighter oversight of powerful models and who can access them.

Anthropic says the environment for its cybersecurity tests was supposed to be isolated. However, a “misconfiguration” left the machines Claude accessed “with live internet access,” the company said, and because all models had been “explicitly told” they had no internet access, they “assumed” the real networks it encountered were part of the simulated environment.

The earliest incidents date back to April and involved three different Claude models: Opus 4.7, Mythos 5, and “an internal research test model,” according to the blog post. As the models were being tested on their cyber abilities, Anthropic said they lacked the standard safeguards usually put in place to curtail riskier behavior.

The company said it discovered incidents after reviewing more than 141,000 cybersecurity test runs, something it only did after OpenAI disclosed its rogue AI agent was behind the attack on Hugging Face.

The three models behaved very differently when they encountered information suggesting that the systems they were encountering were, in fact, real. By Anthropic’s account, the oldest model, Opus 4.7, recognized it had reached a real system, “but continued its attack.” Its flagship Mythos 5 figured out it was using the internet but somehow reasoned this was all still part of the simulation, so continued. The internal test model, which Anthropic describes as “our latest model,” stopped the exercise when evidence emerged that its targets were real.

Anthropic did not identify the affected organizations and said it will continue to investigate the incident and provide updates when it can. The company said it is also speaking with AI research nonprofit METR about conducting a third-party review of what happened. OpenAI has also hired METR to conduct an independent review.

Throughout the post, Anthropic repeatedly contrasts both the nature and its handling of the incidents with OpenAI’s, ending with a bulleted, four-point list outlining the differences — and why it believes its own response was better. Anthropic emphasizes that it “proactively” reviewed its tests, and did so before a company detected any activity. It also said its models accessed the internet “via an open path,” rather than using a novel exploit like OpenAI’s agent, adding that its most recent model also stopped when it realized it was working in a real environment.

Anthropic also said its models failed in a different way from OpenAI’s agent, indicating that this was a safer form of failure. “While there is not a perfectly sharp distinction between the two, we believe these incidents to be closer to a harness and operational failure than a model alignment failure,” the company said. In plain English: The Claude models were doing what they were told, while OpenAI’s agent pursued its goal in a way its creators did not intend, described as misalignment in the AI safety world.

Anthropic called on other AI labs to conduct similar proactive reviews of its cyber testing, adding that the discovery underscores the need for stronger controls and safety measures when testing AI systems.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

• Robert Hart

• AI

• Anthropic

• News

• OpenAI

• Security

• Tech