Anthropic accidentally leaks its next flagship model

It turns out you don't need elite state-sponsored hacking skills to dig up internal secrets from one of the world's leading AI labs. You just need to know how to ask their website's content management system.

Anthropic inadvertently exposed nearly 3,000 unpublished assets after leaving them sitting in an unsecured central data store. According to Alexandre Pauwels, a cybersecurity researcher at the University of Cambridge who reviewed the material for Fortune, the files were accessible to anyone with basic technical knowledge who sent requests to the public-facing system. Anthropic rushed to plug the hole on Thursday after being alerted by journalists.

A misconfigured toggle spilled their next frontier model

Anthropic's CMS worked on a "public by default" design, where assets like research papers, graphics, and PDFs remained open to the web unless someone manually marked them as private. Anthropic simply forgot to flip that switch on a batch of files, leaving several drafts and assets accessible via public browser URLs.

Most of the exposed stash was harmless junk: old draft banners, logos, discarded images, and even an internal photo mentioning an employee's parental leave. But mixed into the pile was pure gold for industry watchers.

The files contained details of an upcoming, unreleased AI model that Anthropic described internally as its most capable model yet. Forced to respond, the company acknowledged it is currently testing a new model with early-access customers, claiming it delivers a "step change" in performance with major jumps in reasoning, coding, and cybersecurity. The leak also spilled plans for an upcoming, invite-only U.K. retreat for European CEOs featuring Anthropic CEO Dario Amodei.

Anthropic's spokesperson rushed to clarify that the mess was down to "human error in the CMS configuration" and was completely unrelated to Claude, Cowork, or any of its internal AI coding agents. The company also stressed that no core infrastructure, model weights, customer data, or security systems were compromised.

Why it matters

For a company whose entire brand identity is built on AI safety and technical caution, having your next frontier release spoiled by a misconfigured blog CMS is painfully ironic. It is even funnier watching Anthropic—a lab that routinely brags about automating its internal software engineering with AI agents—scramble to assure everyone that this specific mistake was 100% human stupidity.

Leaving staging assets and sitemaps exposed is an old tech sin; Apple, Google, Tesla, and Nintendo have all leaked roadmaps through misconfigured servers or CDNs. But what makes this slip terrifying today is the environment it lands in.

Tools like Claude Code and Codex have radically democratized automated reconnaissance. Anyone can now tell an AI agent to scrape web endpoints, spot file-naming patterns, and map out unpublished data in minutes. Finding these leaks no longer takes hours of manual hunting; modern developer tools do it on autopilot.

In our view, this is a loud wake-up call for AI vendors. You can build fortresses around your training clusters and private model weights, but if your marketing team's third-party CMS runs on a public-by-default architecture, your biggest trade secrets are just one AI script away from hitting the front page.