Anthropic Leaks 3,000 Internal Files in CMS Misconfiguration

Add us on Google

Anthropic, the AI company that has built its reputation on caution and constitutional principles, just handed the industry a textbook case of how even the most safety-obsessed players can trip over the basics.

On March 26, a misconfigured content management system left nearly 3,000 unpublished assets, draft blog posts, images, PDFs, and assorted internal files, sitting in a publicly accessible data cache tied to the company’s website. Anyone with a modest amount of technical curiosity could have queried the store and pulled down the material. No passwords, no authentication walls, just files that should have remained behind the curtain.

The exposure wasn’t the result of a sophisticated breach. Fortune, which first reported the lapse, described it as a straightforward configuration error: the CMS tool Anthropic uses to stage and publish blog content had its defaults set so that draft assets were public by default. An external service appears to have been involved, and the company later chalked it up to “human error in the CMS configuration.” Once notified, Anthropic moved quickly to lock everything down. But by then the damage, in the form of leaked road-map details, was done.

Buried among the drafts was a would-be announcement for the company’s next flagship model, internally codenamed Claude Mythos and positioned on a new tier called Capybara, sitting above the current Opus line. According to the leaked documents, Mythos represents what Anthropic itself calls a “step change” in capabilities, dramatically stronger performance in reasoning, coding, and, notably, cybersecurity tasks. The company has now confirmed it has completed training and is already testing the model with a small group of early-access customers. It is not yet ready for broad release, in part because its cyber capabilities are considered so advanced that Anthropic is proceeding with extreme caution.

That last detail is telling. The very documents that accidentally went public flagged the model’s potential to enable large-scale cyberattacks if misused. Anthropic’s own internal thinking, as reflected in the drafts, frames the rollout as a delicate balancing act: powerful enough to be transformative, risky enough that the company wants to share early results with cyber defenders before wider deployment. In other words, the leak didn’t just reveal a new model; it surfaced the company’s own pre-release anxiety about what it had built.

Other bits of the cache were less explosive but still revealing: planning notes for an invite-only CEO retreat in the U.K. that Dario Amodei was scheduled to attend, assorted discarded graphics, and the usual detritus of content workflows. None of it touched customer data, production AI systems, or core infrastructure, Anthropic stressed in its statement. Still, the episode lands awkwardly for a firm whose entire brand rests on meticulous risk management.

Cybersecurity researcher Alexandre Pauwels of the University of Cambridge reviewed the material at Fortune’s request and confirmed the scale, close to 3,000 unpublished assets. Other security voices, including researchers at LayerX, have also weighed in, underscoring how routine such exposures have become in the AI sector. The tools that help teams move faster, CMS platforms, staging environments, AI-assisted content pipelines, are the same ones that can quietly expose half-finished strategies to the open internet.

The timing adds another layer. Anthropic and its peers are sprinting toward ever-larger models while also navigating investor pressure and, in some cases, IPO speculation. OpenAI has its own aggressive timeline; Google and Meta are pouring resources into frontier systems. In that environment, a leaked glimpse of the next benchmark-setter is more than embarrassing, it’s competitive intelligence handed over for free. The fact that the leak also highlighted genuine cybersecurity risks only amplifies the irony: a company that warns the world about powerful AI is momentarily unable to keep its own warnings under wraps.

None of this suggests malice or negligence on the scale of a major breach. No evidence points to malicious actors exploiting the data before it was secured, and Anthropic’s rapid response once alerted was textbook. But the incident does illustrate a broader, quieter problem in the AI race. As companies race to ship, the mundane plumbing, content pipelines, staging servers, default permissions, often receives less scrutiny than the models themselves. AI coding assistants, ironically, can make it even easier for outsiders to scan for these misconfigurations by generating the exact scripts needed to probe public assets.

For Anthropic, the episode is a reminder that safety isn’t just about model behavior; it’s also about operational hygiene. The company has spent years positioning itself as the thoughtful alternative to more reckless players. This week it got an unwelcome lesson in how quickly a simple oversight can undercut that narrative. The model it accidentally spotlighted may indeed be its most impressive yet. Whether the company’s own data-handling practices keep pace with that ambition is now part of the public conversation, whether Anthropic likes it or not.