Anthropic said Thursday that an internal investigation uncovered three incidents in which its AI model Claude breached the systems of three organizations while conducting cybersecurity tests. The investigation, and disclosure, comes more than a week after OpenAI disclosed that one of its unreleased models breached Hugging Face’s systems during internal testing.

In all three cases, a Claude model reached the internet from within a testing environment while interacting with a third party and then gained unauthorized access to the live systems of these organizations, Anthropic said in a blog post, describing what it found and what the company plans to change to prevent this from happening again.

Anthropic said the July 21 OpenAI incident prompted the company to conduct its own cybersecurity evaluation. It specifically looked for evidence that Claude had accessed the internet from within testing environments, which are designed to act as sandboxes and keep models isolated.

Among the 141,006 evaluation runs it reviewed, the AI lab found three incidents in which its model accessed the internet while interacting with Irregular, one of its third-party partners. Anthropic said the access traced back to a misconfiguration in the evaluation environment run with Irregular. It called this a “misunderstanding” between the two companies over whether the test setup had internet access, when in fact it did. Anthropic said it isn’t placing blame and is “approaching the fixes as if the responsibility were ours alone,” while observing that Irregular is conducting its own separate investigation.

Either way, because of that open connection, the model gained unauthorized access to the production infrastructure of three different organizations. Anthropic said the incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model.

Notably, Anthropic said that in each of these cases “Claude was explicitly told by our prompt that it had no internet access.” It appears that the AI model assumed real-world systems to be part of the exercise it was asked to perform.

That assumption didn’t hold up uniformly, as it turns out. The three models didn’t behave the same way once evidence emerged that their targets were real, which Anthropic flagged as one of the more eye-opening findings.

Opus 4.7, the oldest of the three, recognized that it had reached a real production system in all four runs of that incident. In two of them, it rationalized that the real company must somehow be part of the exercise, but in all four, it kept attacking anyway, including pulling credentials and touching a database of production data. Mythos 5 also picked up on signs that it was on the real internet, but it talked itself back into believing it was still in a simulation, going on to publish a malicious software package to the public Python software registry PyPI, which was downloaded and run by outside systems before being caught. Only the internal research test model, Anthropic’s newest, stopped on its own once it concluded the target was real.

In response, Anthropic said significant controls must be placed on these kinds of evaluations if powerful AI models are involved, echoing some sentiments within the cybersecurity community.

The company also noted that Claude was running without the additional safety monitoring and classifiers it deploys on generally available models, safeguards it said would have blocked the behavior, because the evaluations are designed to measure the underlying model’s raw capabilities.

Importantly, Anthropic said it found no evidence of any model “pursuing a goal of its own” and instead merely tried to complete the task it was asked to do.

Though comparisons between the two incidents are inevitable, Anthropic drew a clear distinction between its incidents and OpenAI’s, noting where OpenAI’s model exploited an unknown software vulnerability to break out of its test environment, Anthropic’s models instead reached the internet through a path that had, by mistake, been left open.

OpenAI has continued to release new details about its own breach, saying its models also used publicly exposed credentials across four accounts on four services: one as a staging point, one for storage, and two that were only looked at, not used to break in further, according to OpenAI’s own updated blog post about the incident.

Anthropic also drew a distinction between itself and OpenAI by noting that it discovered the incidents itself, through a proactive review, and that the two affected organizations it was able to reach hadn’t previously detected the activity or flagged it to Anthropic.

The company added that it’s now working with the independent evaluation group METR on a third-party review of the incidents.

OpenAI’s accidental breach of Hugging Face, which was the first verifiable case of an AI lab losing control of its model, sparked a string of reactions from the industry and politicians, many of whom don’t necessarily agree with one another. This latest disclosure from Anthropic ensures the debate over AI models and security will continue.

Situational Awareness, a hedge fund formed by former OpenAI researcher Leopold Aschenbrenner, has sold the majority of its public stock portfolio to Ken Griffin’s Citadel following steep losses over the past month, the Wall Street Journal reported earlier on Thursday. It’s a big comedown for the rising star who has been described as both “scarily smart,” and “brash.”

German-born Aschenbrenner, who is 25, had no prior trading experience before launching the fund in 2024. He gained prominence for his investment thesis after publishing essays arguing that scaling AI would require a major build-up in semiconductors, compute, memory, and energy infrastructure.

He joined OpenAI’s “superalignment” team in 2023, two years after graduating as valedictorian from Columbia at 19 (he enrolled at age 15). But he was dismissed from the company a year later over what it described as an improper disclosure of internal information. At the time, that team was led by OpenAI co-founder Ilya Sutskever and AI researcher Jan Leike. Soon after, Sutskever left to start his own company, Leike joined rival Anthropic, and Aschenbrenner launched his fund.

Things couldn’t have been going better for Situational Awareness until very recently. The fund returned 439% for the year through June, the Financial Times reported. Assets under management reportedly grew to as much as $45 billion during their peak before the fund’s positions began dropping sharply amid a broader decline in AI infrastructure investments, CNBC reported.

Even after losses mounted, Aschenbrenner didn’t flinch. In a July 24 letter to investors seen by the FT, he called the selloff one of the best buying opportunities since early last year and invited clients to commit fresh capital starting August 1. According to Bloomberg, the appeal didn’t garner the commitments he’d hoped would materialize.

Some of the hardest-hit stocks held by the fund included memory chip producers SK Hynix and SanDisk, clean energy developer Bloom Energy, and neocloud provider Nebius Group, all of which have plummeted by more than 30% over the past month. AI infrastructure equities fell as public investors grew concerned that massive capital expenditures weren’t translating into near-term revenue. The fund’s losses were amplified by leverage, a common hedge fund strategy of using borrowed money to buy stocks.

After Citadel bought the bulk of those holdings, Situational Awareness’ overall assets fell to roughly $10 billion, Bloomberg reported, down from around $20 billion in recent months, per an earlier WSJ report.

Situational Awareness raised several hundred million dollars at its outset. Early backers of the fund include quant-trading firm Jane Street, Stripe co-founders Patrick and John Collison, and Meta executives Daniel Gross and Nat Friedman.

Citadel’s purchase fits a familiar pattern for Citadel. Ken Griffin’s hedge fund has a reputation for stepping in to snap up attractive assets when leveraged players are having to unwind themselves. Even before picking up some of Situational Awareness’s holdings, Citadel’s portfolio featured some of the same AI infrastructure bets, suggesting that, like Aschenbrenner, Griffin expects the sector to recover and has the ability to wait it out.

Situational Awareness did not, however, sell its investments in private companies, according to multiple reports. Most notably, it continues to hold a stake in Anthropic that’s right now valued at $5 billion, according to Bloomberg, and which many would view as an asset that continues to appreciate. Indeed, Anthropic was last valued at $965 billion in a Series H round in May, and it’s expected to go public as soon as October, potentially at an even higher valuation. It’s conceivable that a windfall from the sale of those shares could offset some of the hedge fund’s public-market losses.

Other private investments in the portfolio of Situational Awareness include chipmaker MatX and AI data center startup Fluidstack, which was reportedly in talks in April to raise a new round at an $18 billion valuation.

TechCrunch has reached out to Aschenbrenner for comment.

As the generative AI boom drives steep demand for hardware components, Apple and other hardware makers are facing what outgoing CEO Tim Cook calls “a hundred-year flood [on] memory pricing,” which is severely impacting the cost of producing iPhones, MacBooks, and other devices.

Apple described its recent earnings report as its “strongest June quarter ever,” with iPhone and Mac sales performing better than expected, growing 22% and 29% respectively year over year. Yet the company is bracing for memory shortages, known as RAMageddon, to get even worse. Apple’s biggest challenge is securing the advanced memory nodes used in its Apple silicon chips, which power the A-Series and M-Series processors used in iPhones and Macs.

“We continue to expect high levels of demand. However, with less flexibility in supply chain, we expect the impact from the supply constraints to increase significantly sequentially,” Cook said on Apple’s quarterly earnings call. “We’re seeing some very significant constraints currently with limited flexibility in the supply chain to remedy it.”

Apple is evidently worried enough about supply shortages that it reported $11.1 billion in inventory, nearly double the $5.7 billion it reported last September. This marks a break from Cook’s long-held supply chain approach, which has emphasized minimizing how much inventory Apple has on hand.

These constraints led Apple to “reluctantly” raise the price of Macs and iPads last month, Cook added. Other companies that have raised hardware prices include Meta, Samsung, Microsoft, and Sony.

“We’re going to be scrambling on the supply side, essentially,” Cook said.

For the upcoming quarter, Apple is predicting revenue growth between 9% and 11% year over year. But in the last several quarters, Apple has maintained about 16% year-over-year growth. Of course, that worries investors — Apple stock dropped 6% in after-hours trading.

When Senior VP of Hardware Engineering John Ternus steps into the CEO role in September, the company could be facing a rough patch, but at least Apple isn’t alone in its supply struggles.