Anthropic said Thursday that an internal investigation uncovered three incidents in which its AI model Claude breached the systems of three organizations while conducting cybersecurity tests. The investigation, and disclosure, comes more than a week after OpenAI disclosed that one of its unreleased models breached Hugging Face’s systems during internal testing.

In all three cases, a Claude model reached the internet from within a testing environment while interacting with a third party and then gained unauthorized access to the live systems of these organizations, Anthropic said in a blog post, describing what it found and what the company plans to change to prevent this from happening again.

Anthropic said the July 21 OpenAI incident prompted the company to conduct its own cybersecurity evaluation. It specifically looked for evidence that Claude had accessed the internet from within testing environments, which are designed to act as sandboxes and keep models isolated.

Among the 141,006 evaluation runs it reviewed, the AI lab found three incidents in which its model accessed the internet while interacting with Irregular, one of its third-party partners. Anthropic said the access traced back to a misconfiguration in the evaluation environment run with Irregular. It called this a “misunderstanding” between the two companies over whether the test setup had internet access, when in fact it did. Anthropic said it isn’t placing blame and is “approaching the fixes as if the responsibility were ours alone,” while observing that Irregular is conducting its own separate investigation.

Either way, because of that open connection, the model gained unauthorized access to the production infrastructure of three different organizations. Anthropic said the incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model.

Notably, Anthropic said that in each of these cases “Claude was explicitly told by our prompt that it had no internet access.” It appears that the AI model assumed real-world systems to be part of the exercise it was asked to perform.

That assumption didn’t hold up uniformly, as it turns out. The three models didn’t behave the same way once evidence emerged that their targets were real, which Anthropic flagged as one of the more eye-opening findings.

Opus 4.7, the oldest of the three, recognized that it had reached a real production system in all four runs of that incident. In two of them, it rationalized that the real company must somehow be part of the exercise, but in all four, it kept attacking anyway, including pulling credentials and touching a database of production data. Mythos 5 also picked up on signs that it was on the real internet, but it talked itself back into believing it was still in a simulation, going on to publish a malicious software package to the public Python software registry PyPI, which was downloaded and run by outside systems before being caught. Only the internal research test model, Anthropic’s newest, stopped on its own once it concluded the target was real.

In response, Anthropic said significant controls must be placed on these kinds of evaluations if powerful AI models are involved, echoing some sentiments within the cybersecurity community.

The company also noted that Claude was running without the additional safety monitoring and classifiers it deploys on generally available models, safeguards it said would have blocked the behavior, because the evaluations are designed to measure the underlying model’s raw capabilities.

Importantly, Anthropic said it found no evidence of any model “pursuing a goal of its own” and instead merely tried to complete the task it was asked to do.

Though comparisons between the two incidents are inevitable, Anthropic drew a clear distinction between its incidents and OpenAI’s, noting where OpenAI’s model exploited an unknown software vulnerability to break out of its test environment, Anthropic’s models instead reached the internet through a path that had, by mistake, been left open.

OpenAI has continued to release new details about its own breach, saying its models also used publicly exposed credentials across four accounts on four services: one as a staging point, one for storage, and two that were only looked at, not used to break in further, according to OpenAI’s own updated blog post about the incident.

Anthropic also drew a distinction between itself and OpenAI by noting that it discovered the incidents itself, through a proactive review, and that the two affected organizations it was able to reach hadn’t previously detected the activity or flagged it to Anthropic.

The company added that it’s now working with the independent evaluation group METR on a third-party review of the incidents.

OpenAI’s accidental breach of Hugging Face, which was the first verifiable case of an AI lab losing control of its model, sparked a string of reactions from the industry and politicians, many of whom don’t necessarily agree with one another. This latest disclosure from Anthropic ensures the debate over AI models and security will continue.

Situational Awareness, a hedge fund formed by former OpenAI researcher Leopold Aschenbrenner, has sold the majority of its public stock portfolio to Ken Griffin’s Citadel following steep losses over the past month, the Wall Street Journal reported earlier on Thursday. It’s a big comedown for the rising star who has been described as both “scarily smart,” and “brash.”

German-born Aschenbrenner, who is 25, had no prior trading experience before launching the fund in 2024. He gained prominence for his investment thesis after publishing essays arguing that scaling AI would require a major build-up in semiconductors, compute, memory, and energy infrastructure.

He joined OpenAI’s “superalignment” team in 2023, two years after graduating as valedictorian from Columbia at 19 (he enrolled at age 15). But he was dismissed from the company a year later over what it described as an improper disclosure of internal information. At the time, that team was led by OpenAI co-founder Ilya Sutskever and AI researcher Jan Leike. Soon after, Sutskever left to start his own company, Leike joined rival Anthropic, and Aschenbrenner launched his fund.

Things couldn’t have been going better for Situational Awareness until very recently. The fund returned 439% for the year through June, the Financial Times reported. Assets under management reportedly grew to as much as $45 billion during their peak before the fund’s positions began dropping sharply amid a broader decline in AI infrastructure investments, CNBC reported.

Even after losses mounted, Aschenbrenner didn’t flinch. In a July 24 letter to investors seen by the FT, he called the selloff one of the best buying opportunities since early last year and invited clients to commit fresh capital starting August 1. According to Bloomberg, the appeal didn’t garner the commitments he’d hoped would materialize.

Some of the hardest-hit stocks held by the fund included memory chip producers SK Hynix and SanDisk, clean energy developer Bloom Energy, and neocloud provider Nebius Group, all of which have plummeted by more than 30% over the past month. AI infrastructure equities fell as public investors grew concerned that massive capital expenditures weren’t translating into near-term revenue. The fund’s losses were amplified by leverage, a common hedge fund strategy of using borrowed money to buy stocks.

After Citadel bought the bulk of those holdings, Situational Awareness’ overall assets fell to roughly $10 billion, Bloomberg reported, down from around $20 billion in recent months, per an earlier WSJ report.

Situational Awareness raised several hundred million dollars at its outset. Early backers of the fund include quant-trading firm Jane Street, Stripe co-founders Patrick and John Collison, and Meta executives Daniel Gross and Nat Friedman.

Citadel’s purchase fits a familiar pattern for Citadel. Ken Griffin’s hedge fund has a reputation for stepping in to snap up attractive assets when leveraged players are having to unwind themselves. Even before picking up some of Situational Awareness’s holdings, Citadel’s portfolio featured some of the same AI infrastructure bets, suggesting that, like Aschenbrenner, Griffin expects the sector to recover and has the ability to wait it out.

Situational Awareness did not, however, sell its investments in private companies, according to multiple reports. Most notably, it continues to hold a stake in Anthropic that’s right now valued at $5 billion, according to Bloomberg, and which many would view as an asset that continues to appreciate. Indeed, Anthropic was last valued at $965 billion in a Series H round in May, and it’s expected to go public as soon as October, potentially at an even higher valuation. It’s conceivable that a windfall from the sale of those shares could offset some of the hedge fund’s public-market losses.

Other private investments in the portfolio of Situational Awareness include chipmaker MatX and AI data center startup Fluidstack, which was reportedly in talks in April to raise a new round at an $18 billion valuation.

TechCrunch has reached out to Aschenbrenner for comment.

Reddit reported a strong second quarter but spooked investors by mentioning in an investor letter that traffic from search engines had grown “choppy.”

The company’s total revenue of $805 million jumped 61% compared to the year-ago quarter while net income was $253 million, up 183%. These beat Wall Street’s expectations. Plus, the company said it expects to hit revenue of $860 million to $870 million with healthy earnings before taxes next quarter as well, which beat expected guidance.

Normally, telling investors that they can expect even better results to come would cause a stock to rise. But the stock slid over 10% in after-hours trading.

The culprit was likely CEO Steve Huffman’s warning in that separate letter to shareholders. “Search referrals were choppy in the quarter, and traffic was more volatile later in the quarter, but the bigger picture is unchanged: the commercial business is strong,” he wrote.

AI is clearly changing the search engine landscape — and investors seem to fear that Reddit’s traffic may suffer.

In 2024, Reddit signed a contract to provide its content to Google for the purposes of AI training. However, Google’s deployment of AI summaries appears to be peeling away audience share from Reddit, and the site has signaled it’s not sure whether it will renew the partnership with the search giant.

Another sticking point has been whether Reddit’s audience is growing in the right places or not. Reddit’s global users are up, but the platform saw U.S. users, in terms of daily active uniques, endure a very slight decline — 53.2 million from 53.5 million in Q1.

During Thursday’s earnings call, some analysts aggressively questioned AI’s impact on Reddit’s audience.

“I don’t want to belabor this point, but your stock is down sharply because there is just a sense from investors that you have a — I don’t want to, to be blunt — a user problem, especially in the U.S.,” one Wall Street analyst said.

“People are looking at the daily and saying, you know, the logged-out traffic is going to be under pressure because as search shifts to AI, you’re not going to get referrals, and that it’s going to be harder to get people to go from logged-out to logged-in, and that’s sort of symptomatic of what you’re seeing,” the analyst continued, asking “Do you see any world where you’re not licensing data to Google and OpenAI next year?”

Huffman said that he felt that the human aspect of Reddit would continue to make it a destination for users. “Reddit is communities and conversation. Communities are universal, and so we think we have in the U.S. content for everyone, and it’s a matter of revealing that. And we’re making progress towards that end,” Huffman said.

When it comes to Google, Huffman was vaguer. “Our relationship with them actually predates the formal kind of data licensing agreements,” he said. “I don’t think there’s a binary outcome…we will make sure that we’re maximizing the value for Reddit.”