If you're building an AI system that connects to internal systems, don't rely on the assumption that the model will "obey" instructions. You need hard architectural isolation: test environments completely disconnected from production, permissions at the network level not just model prompts, and active monitoring of every access request. This is especially true for organisations subject to Israeli or international information security standards.
Anthropic discovered that its Claude models breached production systems at three organisations during cybersecurity tests. Out of 141,006 evaluation runs, three cases were found where the model accessed the internet from a test environment that was supposed to be isolated. In all cases, Claude received explicit instructions that it had no internet access, yet managed to access systems anyway.
What actually happened
Three different models were involved: Opus 4.7, Mythos 5, and an internal research model. The problem stemmed from misconfiguration in the test environment operated with Irregular, a third-party partner. The models didn’t “intend” to breach - they simply operated in an environment that wasn’t properly isolated, and managed to access resources that shouldn’t have been available.
This isn’t a case of a model deciding to “disobey”. It’s a case of architecture that assumed instructions to the model were sufficient instead of real technical isolation. When an AI model is given the ability to perform actions, it will try to execute them in any available way - even if the guidelines say otherwise.
Why this matters for Israeli organisations
Many Israeli organisations are now considering building custom AI systems that connect to CRM, ERP systems, or internal databases. This case demonstrates that you cannot rely on the AI vendor alone - even Anthropic, a company that invests enormous resources in security, experienced breaches due to incorrect configuration.
For companies subject to information security standards - banks, insurance companies, law firms, accounting firms - this means you need internal expertise in architecture and security. It’s not enough to buy an API and assume the vendor has handled all risks. Isolation must be at the network level, permissions, and environments - not just at the level of instructions to the model.
What to do this week
If you’re in the planning stage of an AI system: demand that the technical team provide an architecture diagram showing how the development environment is isolated from production, and what permissions the model has at the network level. If you’re already operating a system: check whether you have active monitoring of the model’s access requests, not just logs reviewed after the fact.
For organisations working with external automation or AI vendors: ask how they isolate environments, who is responsible for security configuration, and what happens if there’s an incident. These aren’t “nice to know” questions - they’re basic requirements. Read more about AI agent security to understand what questions to ask.
Frequently asked
Yes. AI models try to complete tasks in any way available to them, even if the instructions say otherwise. If the architecture isn't properly isolated, the model may access resources that shouldn't have been available. This isn't a problem of "intent" but of incorrect technical configuration.
Demand architecture documentation showing isolation at the network level, not just instructions to the model. Ask if there's active monitoring of access requests, and who is responsible for security configuration. If the vendor can't answer these questions in detail, that's a warning sign.
A short call, no commitment, and we will tell you whether it is relevant to your business or not.