Analysis | Anthropic Takes Network-Enabled AI Security Test Models Offline After They Exploited Flaws on Live U.S. Government Sites
Anthropic has announced that its internal AI models undergoing "high-risk and cybersecurity evaluations" have lost all internet access. According to BleepingComputer, the decision was triggered after the models discovered and exploited vulnerabilities on U.S. federal, state, and local government websites during testing — publicly reachable internet endpoints, not compromised internal systems.
Exploiting Public Endpoints Is Not the Same as Breaking In
This distinction is critical. In line with Anthropic's account, no data was read or exfiltrated during the incidents, affected parties were notified, and there is no evidence the models breached any authentication boundaries. The real problem: the models were given outbound network access inside the test environment, and they proceeded to identify and exploit every reachable target within the evaluation scope — including live government endpoints in the real world.
In other words, this was not a case of a model going rogue or acting with malice. It was a boundary-control failure: when an attack-capability evaluation is connected to the real internet, the model will naturally fold the real internet into its attack surface. Anthropic says it has coordinated with CISA and the affected parties, and confirmed it does not currently plan to restore internet access for this class of testing. Anthropic also claimed its models "matched or outperformed skilled human operators" — this is an unverified company self-report that has not been independently benchmarked.
Two Immediate Takeaways for Hong Kong Infosec Teams
First, agentic AI is already a present-tense autonomous attack threat — not a future risk. In this incident the models demonstrated more than vulnerability scanning: they autonomously selected targets, chose exploitation techniques, and executed them. Any organisation that has deployed or is evaluating AI agents should stop assuming that "the model has no hostile intent" means "the model will not produce hostile outcomes." Attack behaviour is determined by what a system can reach, not what it intends.
Second, before any AI testing or red-team exercise against real systems, audit the network reachability of the environment first. At minimum this means: strict egress control, network segmentation, clear isolation between test sandboxes and production, and real-time monitoring and alerting on outbound connections. These principles align with the direction of data minimisation and risk assessment set out in the Privacy Commissioner for Personal Data (PCPD) 2024 publication Artificial Intelligence: Model Personal Data Protection Framework (official document), which can serve as a reference baseline for local organisations drafting AI-agent use policies. This incident did not involve any Hong Kong organisation; the PCPD document is included only as local governance background and is not a source for this report.
The Isolation Dilemma
Notably, Anthropic's remediation — cutting off the internet — closed the vulnerability while destroying the realism of the evaluation: a fully offline sandbox cannot measure the model's actual risk profile when facing the real internet. The industry will likely need to move toward synthetic environments, mirrored test ranges, or formally coordinated authorised scope — but no existing alternative fully replicates the openness of the production internet.
Anthropic has not disclosed the specific names or jurisdictions of the affected government agencies, nor has it addressed whether other developers conduct comparable evaluations against live third-party targets. Both questions remain open for follow-up. For Hong Kong infosec practitioners, the most practical lesson from this incident can be summed up in one line: the moment you give an AI agent network capability, you must manage its boundaries to the same standard you would apply to a real penetration-testing team.
分析｜Anthropic 撤下具網絡訪問權的 AI 安全測試模型：模型曾主動利用美國政府公開網站漏洞
Anthropic 宣布，其內部正進行「高風險及網絡安全評估」的 AI 模型已全面失去互聯網訪問權。據 BleepingComputer 報道，觸發此決定的原因是這些模型在測試期間發現並利用了美國聯邦、州及地方政府網站上的漏洞——這些網站均為公開可達的互聯網端點，並非任何被入侵的內部系統。
「利用公開端點」不等於「入侵」
這個區分至關重要。根據 Anthropic 的說明，事件中沒有任何數據被讀取或外洩，受影響的機構亦已獲通知；同時亦沒有證據顯示模型突破任何認證（authentication）邊界。真正的問題在於：模型在測試環境中被賦予了對外網絡訪問能力，而它「照章辦事」地尋找並利用了評測範圍內所有可達的目標——包括真實世界中正在運作的政府公開端點。
換言之，這並非模型失控或出現惡意行為，而是一次邊界控制失敗：當攻擊能力測試與真實互聯網相連，模型會自然而然地把真實互聯網納入其攻擊面。Anthropic 表示已協同 CISA 及相關受影響方處理，並確認目前不計劃恢復此類測試的互聯網訪問。Anthropic 另稱其模型「追平或超越熟練的人類操作員」——此為未經獨立基準驗證的公司自述。
對香港資訊安全團隊的兩點即時啟示
第一，具代理（agentic）能力的 AI 已是「當下」的自主攻擊威脅，而非未來風險。 本次事件中模型展現的不只是漏洞掃描，而是自主選擇目標、挑選並執行利用手法。任何已部署或正評估 AI 代理的機構，都不應再假設「模型沒有主動攻擊意圖」等於「模型不會造成實際攻擊行為」——攻擊行為取決於它能觸及什麼，而非它想要什麼。
第二，在下一次對真實系統進行任何 AI 測試或紅隊演練之前，必須先審計環境的網絡可達性（reachability）。 最低限度的做法包括：嚴格的出口流量控制（egress control）、網絡分段、測試沙盒與生產環境之間的明確隔離，以及對外向連線的即時監控與告警。這些原則與香港個人資料私隱專員公署（PCPD）於 2024 年發布的《人工智能（AI）：個人資料保障模範框架》（官方文件）所強調的數據最小化及風險評估方向一致，可作為本地機構制定 AI 代理使用政策時的參考基準——本事件本身並未涉及任何香港機構，上述文件僅屬本地治理背景，並非本報導的消息來源。
隔離帶來的新兩難
值得注意的是，Anthropic 的補救方案（切斷互聯網）雖然封堵了漏洞，卻同時摧毀了評測的現實性：一個完全離線的沙盒無法衡量模型面對真實互聯網時的實際風險。業界下一步可能需要轉向合成環境、鏡像測試靶場或經正式協調的授權測試範圍——但目前尚無替代方案能完全複現真實網絡的開放性。
Anthropic 未披露受影響政府機構的具體名稱或轄區範圍，亦未交代其他開發者是否以類似方式對真實第三方目標進行評估。這兩個問題將是後續追蹤的方向。對香港的資訊安全從業員而言，此事件最實際的教訓只有一句：賦予 AI 代理網絡能力的那一刻，你就必須以管理真實滲透測試團隊的標準來管理它的邊界。