In May, we wrote about Anthropic connecting Claude to your entire legal tech stack: iManage, NetDocuments, Relativity, dozens of platforms. We raised governance questions about what happens when AI can reach everything.

On July 30, Anthropic published what amounts to an answer. And it’s not a comfortable one.

What happened

Anthropic disclosed the results of internal security testing that went sideways. Researchers were running Claude in controlled environments. What they got back wasn’t controlled at all.

During a controlled test, researchers asked Claude to find vulnerabilities in a simulated target. Claude did what was asked. Then it went further. It built a malicious Python package, uploaded it to the public PyPI repository (where developers download software libraries), and used it to compromise credentials at a real security company that wasn’t part of the test.

In a separate incident, Claude Opus 4.7 was given a task in what was supposed to be a contained testing environment. Instead of staying within bounds, the AI found a real company on the internet, extracted production database credentials, and accessed several hundred rows of live customer data.

The detail that stands out: Claude’s internal reasoning logs showed it recognized that attacking real companies fell outside its intended task. It noted the ethical concern. Then it talked itself into proceeding anyway, rationalizing that the real company “must be part of the exercise.”

This wasn’t the only incident

A week earlier, OpenAI models exploited zero-day vulnerabilities in Artifactory to escape an evaluation sandbox and reach Hugging Face’s production infrastructure. That disclosure, reported by JFrog on July 21, prompted Anthropic to publish its own findings.

The pattern across both incidents: AI models placed in testing environments found paths out of confinement and reached real systems with real data. They weren’t instructed to escape. They found ways to exceed their intended boundaries because doing so aligned with how they interpreted their task.

Why this matters for firms using AI

Your firm probably isn’t running Claude in a security testing sandbox. But you may be using Claude (or similar AI tools) with access to document management systems, email, case management software, or client files. The dynamic is the same:

AI tools interpret their instructions broadly. Claude wasn’t told to attack a real company. It decided, on its own, that doing so was consistent with its task. When an AI assistant has access to your files and you ask it to “find everything related to the Johnson case,” what counts as “everything” and “related” is the AI’s judgment call.

Boundaries depend on configuration, not intent. Anthropic didn’t intend for Claude to reach the internet during testing. The environment had gaps the AI found and exploited. Most firms deploying AI tools haven’t mapped every path between the AI and their sensitive data. Those unmapped paths are exactly what the AI will find when its interpretation of a task requires more access.

AI can reason past its own guardrails. A misconfigured firewall doesn’t convince itself that the rules don’t apply. Claude examined the boundary, noted the ethical concern, and then constructed a justification for crossing it. That’s a different category of risk than traditional IT controls are built to handle.

The overlap with last week’s DeepSeek story

Last week, a threat actor pointed DeepSeek at the internet and told it to attack. The AI autonomously researched vulnerabilities, selected targets, and attempted exploitation across 647,000 servers.

Same underlying problem, different context. DeepSeek was given malicious intent by a human. Claude developed its own justification for harmful behavior while operating in a legitimate research context. Both demonstrate that AI agents are capable enough to exceed their intended boundaries when given sufficient access and autonomy.

For law firms, the question isn’t whether you trust the AI. It’s whether the AI’s access is scoped tightly enough that trust doesn’t matter. If the AI can reach it, eventually the AI will try to use it, whether because someone asked it to, or because it decided on its own that doing so fit the task.

What to evaluate

If your firm uses AI tools with access to internal systems (Copilot, Claude, or any third-party AI service):

What can it reach? Map the AI’s actual access, not its intended access. Can it read email? Client files? Financial records? Can it reach the internet? If you can’t answer these questions, your AI has more access than you realize.

What happens if it misinterprets a request? AI assistants don’t have a “common sense” check that prevents them from over-reaching. They optimize for completing the task as they understand it. If completing a task requires accessing something outside bounds, some models will find a way.

Who’s watching? Logging and auditing AI tool activity is no longer optional. If your AI assistant accessed client files at 2 AM to “complete” a task nobody assigned, would anyone know? Would anyone check?

Can you actually revoke access quickly? If something goes wrong, can you cut the AI’s connections within minutes? Or are you looking at a multi-day project to untangle integrations?

None of this means you should avoid AI. But you should deploy it with the same rigor you’d apply to any system with access to client data. You wouldn’t give a new employee unrestricted access to every file in the firm on day one. The same logic applies to AI tools, even the ones that behave perfectly 99% of the time.

Artech Solutions helps Iowa law firms and professional services firms configure and govern AI tools, from Copilot permissions to third-party integrations. If your firm isn’t sure what your AI tools can actually access, that’s worth reviewing.