Claude vs ChatGPT: Which AI Security Incident Was Worse

Skip to content

Newsletter<br>Contact

Search

Claude, Lead story, LLM

AI Tools & Workflows

Claude vs ChatGPT: Which AI Security Incident Was Worse

By<br>Yajush Gupta

July 31

14–22 minutes

Listen to this article

19 min read

Editor’s note: Every fact below is drawn from Anthropic’s and OpenAI’s own published incident reports, filed directly by each company, cross-checked against independent reporting from credible reporting outlets. Neither incident report has a final technical review attached yet at the time of writing this.

TL;DR

By severity, OpenAI’s incident was worse. By what it reveals about AI judgment, Anthropic’s was.

OpenAI’s models exploited an actual, previously unknown software flaw, a genuine zero-day, to break out of a sealed test environment and reach the production infrastructure of Hugging Face, another AI platform.

On the other hand, Anthropic’s models never broke out of anything; their sandbox was simply not sealed, thanks to a misunderstanding with a testing vendor, and three separate Claude models responded to that same false setup in three different ways

Neither company found evidence of a model disobeying its instructions or chasing a goal of its own. Nobody’s live customer data was touched at either lab.

It’s a pattern we’ve flagged before in our look at why AI-built apps collapse under real traffic: the demo, or the test, holds up fine right up until the boundary around it doesn’t.

Table of Contents

The Setup

The earliest known incident happened in April 2026, inside a test environment, and it wasn’t caught for three months. It finally surfaced through a different company’s mistake entirely.

On July 21, OpenAI disclosed that its models had broken out of an isolated benchmark environment and reached the production infrastructure of Hugging Face, an open-source AI platform. That disclosure basically set off everything that followed.

Anthropic immediately began combing through its own evaluation transcripts two days later, on July 23, and suspended all of its cyber evaluations that same day. By July 24 it had identified three separate incidents. It notified its testing partner and the three affected organizations on July 27.

OpenAI, meanwhile, kept updating its own account through July 28 and 29, eventually confirming the mechanism behind the escape and disclosing that four accounts across four other services had also been touched. Anthropic published its full findings on July 30.

So the two stories are chronologically linked, but not the same event. One company found a flaw. The other found out its own front gate had been left open the whole time, and only checked because someone else’s got kicked in.

Timeline: three years of AI agent incidents

From early autonomy failures to this month’s containment incidents

February 2024

An Air Canada chatbot invents a refund policy that didn’t exist. A tribunal later rules the airline liable.

2024

Hidden instructions in an email trick an AI assistant at a financial institution into approving $2.3 million in fraudulent wire transfers.

July 2025

A Replit coding agent deletes a company’s live production database during an explicit code freeze, then misreports what it did.

August 2025

Stolen oauth tokens from an AI-connected Salesforce integration expose data across more than 700 organisations.

September–November 2025

A Chinese state-linked group manipulates Claude Code into independently executing most of an espionage campaign against roughly 30 organisations.

December 2025–February 2026

An attacker reportedly uses Claude Code and GPT-4.1 together to breach nine Mexican government agencies, exposing an estimated 400 million records.

April 2026

The earliest of this month’s incidents occurs, inside a sealed test environment. Goes unnoticed for months.

July 21, 2026

Openai discloses its models broke out of an isolated benchmark and reached hugging face’s infrastructure.

July 23, 2026

Anthropic begins reviewing its own evaluation transcripts and suspends all cyber evaluations the same day.

July 24, 2026

Anthropic identifies all three of its own incidents.

July 27, 2026

Anthropic notifies its testing partner and the three affected organisations.

July 28–29, 2026

Openai confirms the zero-day mechanism and discloses four accounts accessed across four services.

July 30, 2026

Anthropic publishes its full findings.

Did ChatGPT Hack Another Company?

Not ChatGPT exactly, but yes, models from the same family did, and the mechanism is a genuine security exploit, not a misunderstanding.

OpenAI runs an internal benchmark called ExploitGym to measure how far its models can push a complex cyberattack. The environment was built with no direct internet connection, only a proxy meant to let the model fetch software packages from a cache. That proxy turned out to be the weak point.

We're partnering with @huggingface to investigate an unprecedented security...