Zero Networks Says Microsegmentation Contained Autonomous AI Attack in Anthropic Test

Zero Networks says a test conducted through Anthropic’s Cyber Verification Program examined whether an autonomous AI model could turn an initial compromise into broader access across a mixed IT environment. The exercise used a lab intended to resemble a production network, with Windows, Linux and macOS systems, Kubernetes, and other workloads. One machine was deliberately placed outside segmentation controls as the initial target. Zero Networks identified the model as Claude and said it operated as an autonomous attacker with administrator access and no limits on how it could attempt to attack the environment.

According to Zero Networks, the model compromised the exposed control machine, known as ESTI, obtained administrator access, extracted credential material, and planted a proof file. The company said the model then failed to reach systems and identities protected by microsegmentation, despite repeated attempts to find routes for lateral movement. In some runs, the model reportedly recognized that segmentation prevented access to additional systems and stopped pursuing further attack paths. The reported outcome therefore centers on limiting the consequences of an initial breach, rather than preventing the initial compromise itself.

The company quantified the activity as 18 distinct attack paths, 23 offensive tools, and 22 MITRE ATT&CK techniques. The techniques included Kerberoasting, Active Directory credential extraction, and a Pass-the-Hash attempt against the main target. These details provide security teams and contractors with a scenario to consider when reviewing how segmentation behaves after credentials or administrative access have been obtained. They do not, by themselves, establish that a particular product or architecture will produce the same result in other environments, or that the test represents independent validation.

For government procurement professionals, the source describes a company-reported test finding—not a solicitation, contract award, funding announcement, or new government requirement. No procurement contact or active buying opportunity was identified. The result may nevertheless be useful as a discussion point in capability demonstrations, technical evaluations, and contractor security planning. Buyers should ask vendors to explain the scope and configuration of any comparable testing, how controls contain lateral movement, and what evidence supports performance claims. As Dr. Chase Cunningham, a cybersecurity expert specializing in zero trust architecture, said: “Segmentation is one of the few controls that changes that math regardless of how the attacker thinks or how fast it moves, and this test is a concrete demonstration of why that matters.”

• Test context: Zero Networks participated in Anthropic’s Cyber Verification Program, which addresses security questions involving dual-use AI models.
• Environment: The lab included Windows, Linux and macOS systems, Kubernetes, and other workloads; one machine was intentionally left outside segmentation controls.
• Initial compromise: Zero Networks says Claude gained administrator access to the exposed ESTI control machine, extracted credential material, and planted a proof file.
• Reported activity: The model attempted 18 attack paths, used 23 offensive tools, and touched 22 MITRE ATT&CK techniques.
• Techniques cited: The reported activity included Kerberoasting, Active Directory credential extraction, and a Pass-the-Hash attempt.
• Containment claim: Zero Networks says repeated lateral movement attempts did not reach assets protected by microsegmentation; some runs reportedly ended after the model recognized the barrier.
• Procurement relevance: Government and contractor teams can use the scenario to frame assessments of segmentation and zero-trust controls, while requiring environment-specific evidence.
• Evidence caveat: The result is reported by a participating vendor and should not be treated as independently established product performance.
• Opportunity status: No solicitation, award, funding amount, procurement contact, or new government requirement was identified.