Every model in a ClawSecure test followed hidden instructions planted by an attacker, a result that cuts across the safety claims of some of the world’s best-known artificial intelligence developers. The security research examined 14 models from five frontier labs between May and July 2026.
The attacks used indirect prompt injection, in which instructions hidden within content are treated by an AI system as commands. ClawSecure said Anthropic’s model had a 15.2% attack success rate across two independent surfaces, at odds with Anthropic’s published claim of a “0% attack success rate” on its agentic coding surface.
On a document-render surface, researchers got Anthropic’s model to follow hidden commands in 14 of 15 attempts, a 93.3% total-break rate. In another test, the model fabricated Anthropic citations, invented training figures, made up CVE vulnerability IDs and impersonated named researchers in 8 of 8 attempts, or 100%.
Anthropic’s Claude Opus 4.7 followed hidden attacker commands 26.7% of the time, according to the research. Anthropic’s AI Constitution says instructions within content should be handled “as information rather than as commands that must be heeded”, a principle ClawSecure said it bypassed.
Every company named in the red-teaming research received coordinated disclosure before publication.
The findings come as US agencies have focused on a separate concern: the extraction of knowledge from American frontier models by Chinese AI companies. On 8 September 2026, the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation issued a joint cybersecurity advisory tracking industrial-scale knowledge distillation by six China-based AI companies against American frontier models.
The advisory named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, saying they had run “industrial-scale knowledge distillation campaigns” since at least late 2024. The agencies assessed that the activity was occurring “likely with Chinese government awareness.”
The advisory described distillation as “the core—not merely a supplement” of the named companies’ AI development strategy.
Anthropic said in February 2026 that three of those six companies had generated more than sixteen million suspicious exchanges with Claude through roughly twenty-four thousand fraudulently created accounts. MiniMax accounted for more than thirteen million of the exchanges, Anthropic said.
Google’s Threat Intelligence Group documented an effort to extract reasoning traces from Gemini, identifying more than one hundred thousand prompts across multiple languages.
DeepSeek released its R1 reasoning model in January 2025 and said it had trained the model for approximately $5.6 million.
Anthropic has also set out its own account of the risks. In September 2026, it published a 154-page report titled “Detecting and Countering Misuse of AI”.
China’s Ministry of Commerce called distillation “a neutral technical means used by global model companies including U.S. firms”. It warned of “resolute countermeasures” if the US advisory were used to support new restrictions.
The two strands of evidence point to a difficult security problem. AI developers are trying to prevent models from being manipulated through hostile instructions, while agencies say leading capabilities are being systematically extracted. For users and potential targets of cyberattacks, the question is whether safeguards can keep pace with the systems being deployed.
Comments (0)