AI attacker blocked by microsegmentation in Anthropic test

An Anthropic cyber security evaluation found that a frontier AI model could not move beyond an intentionally exposed machine in a segmented test network, according to Zero Networks. The test examined whether an autonomous AI attacker could turn an initial compromise into wider access across a mixed IT environment.

Zero Networks said the model gained administrator access to the exposed machine and extracted credentials, but failed to breach systems and identities protected by microsegmentation. The attack was contained to the first point of compromise despite repeated lateral movement attempts, it said.

The result comes as security groups and businesses examine how more capable AI systems could affect offensive cyber activity. Recent industry research has raised concerns that AI agents may become more effective at identifying weaknesses, gaining elevated privileges and chaining together multiple attack steps with less human input.

Testing AI attacks

Zero Networks took part in Anthropic's Cyber Verification Program, which is designed to test security questions involving dual-use AI models. For the exercise, the company set up a lab intended to resemble a production environment, including Windows, Linux and macOS systems, Kubernetes and other workloads.

One machine was deliberately left outside the segmentation controls and served as the initial target. The AI model, identified by Zero Networks as Claude, was then deployed as an autonomous attacker with administrator access and no limits on how it could try to attack the environment.

During the exercise, the model attempted 18 distinct attack paths, used 23 offensive tools and touched 22 MITRE ATT&CK techniques, according to Zero Networks. Those included Kerberoasting, Active Directory credential extraction and a Pass-the-Hash attempt against the main target.

Zero Networks said the model successfully compromised the control machine, known as ESTI, obtained administrator access, extracted credential material and planted a proof file. It was then unable to use those gains to reach protected assets elsewhere in the network, the company said.

In some runs, the model recognised that segmentation blocked access to additional systems and stopped pursuing further attack paths, according to Zero Networks. That suggests the test was not limited to a single failed exploit, but included repeated attempts to find alternative routes after the first breach.

Containing intrusions

The findings feed into a broader cyber security debate over whether defensive architecture matters more as attacks become more automated. If AI tools reduce the time and effort needed to probe a network, defenders may have less opportunity to rely on analysts spotting suspicious behaviour before an intruder reaches sensitive systems.

"AI is going to make attackers faster, more persistent and increasingly autonomous. Security teams aren't going to win by trying to out-click or out-think machines operating at machine speed," said Benny Lakunishok, Chief Executive Officer and Co-Founder of Zero Networks.

He said the test reflected a core design principle. "The answer is to build environments where compromising one machine doesn't give the attacker somewhere else to go. That's what this test demonstrated: the attacker got in, had credentials and had every incentive to keep moving. The architecture stopped it."

The issue has drawn attention beyond specialist cyber security teams because several leading AI developers have reported that advanced models can already assist with technical tasks that were once more firmly human-led. That has raised concern that threat actors could eventually use autonomous agents not only to speed up known attack methods, but also to adapt during an intrusion.

AI security concerns

Dr Chase Cunningham, a cyber security expert specialising in zero trust architecture, said the significance lay in what happens after initial access has been achieved. He linked the test to a wider concern that autonomous systems could operate without the usual limits of human attackers.

"What OpenAI disclosed should worry people well beyond the security team: autonomous agents finding each other, colluding, and escalating access without a human in the loop," said Dr Chase Cunningham, Cyber Security Expert specialising in zero trust architecture.

He added: "The infrastructure the world actually runs on was never built to assume the attacker on the other end doesn't get tired. Segmentation is one of the few controls that changes that math regardless of how the attacker thinks or how fast it moves, and this test is a concrete demonstration of why that matters."

Network segmentation has long been recommended by government-backed cyber agencies including CISA in the US and the National Cyber Security Centre in the UK as a way to limit lateral movement after a breach. The concept is not new, but the latest test places it in the context of AI-driven intrusions rather than conventional human-led attacks.

For vendors and security leaders alike, that distinction is becoming more important. The question is shifting from whether an endpoint can be compromised to how much of the wider environment remains reachable once that has happened.

In Zero Networks' evaluation, the model could not get beyond the first machine despite gaining administrator access and extracting credentials.