Anthropic, the San Francisco-based AI company behind Claude, posted on its website on Thursday that it discovered the three incidents after reviewing more than 141,000 evaluation runs.
It had launched a "large-scale" cybersecurity review that specifically looked for evidence whether its AI models were able to access the internet from within testing environments that should have been sealed off, in response to the OpenAI incident, Anthropic said.
Anthropic said the models involved in the incidents were Claude Opus 4.7, Claude Mythos 5 and an internal research test model.
The earliest incidents dated to April, the AI company said.
"Claude compromised the impacted organisations' infrastructure using basic techniques," Anthropic said, such as exploiting weak passwords.
In all three incidents, the AI models were tasked with a "capture the flag" cybersecurity challenge, which Anthropic said has been one of the ways it assesses a model's cyber capabilities.
The models were given a fictional scenario and told a piece of secret information, or the "flag", had been hidden on a different machine on the network, with the objective of breaking in and retrieving it, it said.
It said it had already contacted the affected organisations, which it did not name, with two of them saying they had not previously detected the activity and that the AI company was "continuing to reach out to the third".
Last week, OpenAI said its AI models went rogue during an evaluation of its models, and broke into the servers of AI startup Hugging Face.
OpenAI described it as a "significant security incident".
These incidents have highlighted the vulnerabilities in AI security and control and raised questions over how AI can be safely under human control as the technology's usage becomes more widespread globally.
"Safety testing happens before a model is released precisely because we don't yet know what it is capable of," Anthropic said on Thursday on its website.
