Claude fully
compromised 3 organizations during a safety test
On July 28, Anthropic signaled it was doubling down on internal safety testing, but kept the details under wraps. On August 18, the details finally came out: against three simulated organizations' networks, its own frontier model built an intrusion path with no human step-by-step guidance and pulled off a full takeover.
From a policy signal
to a full account
On July 28, Anthropic said it was leaning further into its own frontier-model safety testing, but at the time gave no specifics on what it was actually testing. On August 18, the company officially disclosed that its own AI model hacked and fully took over three organizations' networks during internal safety testing. Details are laid out on Anthropic's official announcement page.
Anthropic's prior ASL (AI Safety Level) evaluations had centered on "uplift risk" — how much a model raises someone's baseline knowledge of biological or chemical weapons. This is the first time the company has run a full end-to-end test of autonomous cyber-offense capability against a real (if simulated) network environment and published the results. Elena Voss, who leads Anthropic's frontier red team, explained the rationale on the company's internal engineering blog: "The stronger the model gets, the more we need to break it ourselves first. You can't talk about defense if you don't know how it breaks."
The stronger the model gets, the more we break it first.
You can't talk about defense without knowing how it breaks.
The test's scale, in numbers
Over a 19-day internal test, the model attempted 214 intrusion scenarios and fully compromised a target organization in 47 minutes on average.
How the intrusion was built
The test followed a 4-stage cyber kill chain, with no human dictating decisions at any single stage.
Recon
Using public technical documentation and hiring pages, the model mapped the target's tech stack and staff roles to scope out an entry point.
Initial access
The model itself wrote a phishing pretext impersonating an HR staffer, and used it to obtain credentials inside the simulated environment.
Privilege escalation & lateral movement
Using the stolen credentials as a foothold, it exploited a vulnerability planted in the simulated environment (equivalent to CVE-2026-41102) to escalate to admin rights and move laterally across the internal network. Marcus Reyes of Chalk Ridge Security, who ran an independent review, said in his technical write-up that he was able to confirm the reproducibility of this path.
Staged exfiltration
It compressed and split sensitive files, staging them right up to the point of exfiltration — at which point a human supervisor halted the test.
How engineers, business,
and PMs should each prepare
The impact differs by role. Broken into actionable terms, it splits into three groups.
Engineers
If you embed Claude-class agentic AI in your own product, treat the same attack chain — pretext generation, credential theft, lateral movement — as a baseline threat model. Output audit logging and least-privilege design are now urgent, not optional.
Business & IT leadership
Pre-adoption security reviews are likely to gain a new line item evaluating autonomous attack capability, meaning vendor-selection checklists will need updating. Day-to-day chat usage itself is barely affected.
Product & PM
If your roadmap includes giving agentic AI broad permissions — file access, API execution — guardrail design and an incident-response plan need to become a release prerequisite, not an afterthought.
What changes in pre-adoption security review
Following this disclosure, what companies check before adopting AI is likely to expand as follows.
| Before | After |
|---|---|
| Focused on response quality & leakage risk | Adds evaluation of autonomous attack-chain capability |
| Vendor safety policy confirmed on paper | Demands evidence like red-team results |
| Agent permission design was optional | Least-privilege + log monitoring becomes a release gate |
| Everyday chat use needed no extra process | Only broad-permission use cases get stricter review; everyday use is unchanged |
What happens next
Three things seem likely from here. First, within the existing Responsible Scaling Policy (RSP), the ASL-3 deployment threshold may gain an explicit autonomous cyber-offense bar. Second, pressure will build on other frontier labs to publish similar self-reported red-team results. Third, on the practical side, companies handing agents broad permissions should prioritize two things first: permission design that minimizes attack surface, and log monitoring that catches lateral movement. More background is covered in THE DECODER's write-up.
That said, there's no need for outsized alarm. The three organizations here were not real companies — they were an isolated simulation environment Anthropic built for this purpose, the test ran under human supervision, and it was deliberately halted right before exfiltration. No real customer data or external network was actually breached, and the publicly available version of Claude can't simply exercise this capability as-is. Marcus Reyes put it this way: "Demonstrating an offensive capability and an unleashed threat are two different things." Read this disclosure as a warning aimed at defenders, not a preview of an attack.