Investigating Three Real-World Cybersecurity Incidents in Our Evaluations

Investigating three real-world incidents in our cybersecurity evaluations

Following OpenAI's recent disclosure, we reviewed 141,006 cybersecurity evaluation runs and found three incidents where Claude models accessed the internet from sealed test environments. Due to a misconfiguration with our partner Irregular, the models treated real organizations as part of a simulation, exploiting weak passwords to gain unauthorized access. We immediately halted evaluations, notified affected parties, and are implementing stricter safeguards to prevent future occurrences.