Zero Networks today announced results from its participation in the Anthropic Cyber Verification Program showing that a frontier AI model was unable to move beyond an intentionally exposed machine after gaining administrator access and extracting credentials. In the evaluation, Zero Networks’ microsegmentation prevented the model from breaching protected systems and identities, containing the attack to the initial point of compromise.
The result addresses a growing security question as frontier AI models become increasingly capable of autonomous offensive activity: what happens when an AI attacker gets inside a network? Recent research from OpenAI showed AI agents discovering vulnerabilities, obtaining elevated privileges and ultimately contributing to the compromise of Hugging Face infrastructure. OpenAI researchers have warned that threat actors could eventually deploy similar autonomous agents against enterprises.
Zero Networks was accepted into Anthropic’s Cyber Verification Program to conduct deeper security testing using Anthropic’s dual-use AI research capabilities. The evaluation put a frontier AI model against a realistic, heterogeneous network environment and tested whether it could use compromised credentials and offensive techniques to move laterally through the environment.
The model successfully compromised the one machine deliberately left outside Zero Networks’ segmentation controls, gained administrator access and extracted credential material. But when it attempted to use those capabilities to reach protected assets, segmentation prevented further attacker movement. Across the evaluation, the model attempted 18 distinct attack paths using 23 offensive tools and touching 22 MITRE ATT&CK techniques, but did not move beyond the initially compromised machine.
In some runs, the model recognized that Zero Networks’ segmentation prevented access to additional systems and stopped pursuing further attack paths.
AI Makes the Attacker Faster. Segmentation Makes Faster Irrelevant.
Frontier models are increasingly capable of discovering vulnerabilities, obtaining credentials, reasoning through multi-step attack paths and operating with less human intervention. That makes the traditional question of whether an attacker can compromise an endpoint only part of the problem. The more consequential question: what that attacker can reach after the initial compromise?
Zero Networks conducted its Anthropic evaluation to test the defensive side of that equation: if a highly capable AI attacker gets a foothold and acquires credentials, can architecture prevent it from turning that foothold into lateral movement?
The evaluation showed that, in the tested environment, the answer was yes.
Methodology
Zero Networks built a large lab environment designed to resemble a production network, including Windows, Linux and macOS systems, Kubernetes and heterogeneous workloads. The company then applied Zero Networks microsegmentation to protect the assets and identities within the environment.
One machine was intentionally left unsegmented to serve as the control and initial point of compromise.
A frontier AI model was deployed as an autonomous attacker with administrator access and no restrictions on how it could attempt to attack the environment. The evaluation tested the model’s ability to compromise systems, obtain credentials and pursue lateral movement using offensive security tools and techniques.
Claude attempted 18 distinct attack paths using 23 offensive tools and 22 MITRE ATT&CK techniques, including Kerberoasting, Active Directory credential extraction and a Pass-the-Hash attempt against the primary target. MITRE ATT&CK is the cybersecurity industry’s standard framework for cataloging the tactics and techniques used by real-world attackers, so using 22 different techniques shows that Claude was not simply trying one exploit repeatedly, it was moving through a broad range of recognized attack behaviors, much like a human red team or sophisticated adversary would.
Claude successfully compromised ESTI, gained administrator access, extracted credential material and planted the proof file. It was unable to use those capabilities to move into systems protected by Zero Networks segmentation.
Additional Resources
- Download the full technical report here.
- Join Zero’s October webinar, “AI vs Architecture: How to Win Against Machine-Speed Attacks” to learn how to win against AI attacks
- Get the Mythos Readiness Pack – which includes a board-ready deck on AI threat exposure, a Breach Map tool that shows how far a single compromise could spread in your network, and an AI threat brief for your board.
- The Cyber Resilience Toolkit for CISOs: This in-depth enablement kit provides three working guides, a cyber resilience guide, and a board-ready reporting deck for CISOs. Inside, there are interactive worksheets, conversation frameworks, and scoring templates to help CISOs find their critical assets, score their exposure to lateral movement, and align their executive team to act on it.
- Watch on demand: “Mythos and Daybreak: What Boards Are Asking and What to Actually Do About It”
Related
This entry was posted on October 21, 2026 at 9:00 am and is filed under Commentary with tags Zero Networks. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Zero Networks Joins Anthropic Cyber Verification Program to Test AI Powered Attacks Against Microsegmented Networks
Zero Networks today announced results from its participation in the Anthropic Cyber Verification Program showing that a frontier AI model was unable to move beyond an intentionally exposed machine after gaining administrator access and extracting credentials. In the evaluation, Zero Networks’ microsegmentation prevented the model from breaching protected systems and identities, containing the attack to the initial point of compromise.
The result addresses a growing security question as frontier AI models become increasingly capable of autonomous offensive activity: what happens when an AI attacker gets inside a network? Recent research from OpenAI showed AI agents discovering vulnerabilities, obtaining elevated privileges and ultimately contributing to the compromise of Hugging Face infrastructure. OpenAI researchers have warned that threat actors could eventually deploy similar autonomous agents against enterprises.
Zero Networks was accepted into Anthropic’s Cyber Verification Program to conduct deeper security testing using Anthropic’s dual-use AI research capabilities. The evaluation put a frontier AI model against a realistic, heterogeneous network environment and tested whether it could use compromised credentials and offensive techniques to move laterally through the environment.
The model successfully compromised the one machine deliberately left outside Zero Networks’ segmentation controls, gained administrator access and extracted credential material. But when it attempted to use those capabilities to reach protected assets, segmentation prevented further attacker movement. Across the evaluation, the model attempted 18 distinct attack paths using 23 offensive tools and touching 22 MITRE ATT&CK techniques, but did not move beyond the initially compromised machine.
In some runs, the model recognized that Zero Networks’ segmentation prevented access to additional systems and stopped pursuing further attack paths.
AI Makes the Attacker Faster. Segmentation Makes Faster Irrelevant.
Frontier models are increasingly capable of discovering vulnerabilities, obtaining credentials, reasoning through multi-step attack paths and operating with less human intervention. That makes the traditional question of whether an attacker can compromise an endpoint only part of the problem. The more consequential question: what that attacker can reach after the initial compromise?
Zero Networks conducted its Anthropic evaluation to test the defensive side of that equation: if a highly capable AI attacker gets a foothold and acquires credentials, can architecture prevent it from turning that foothold into lateral movement?
The evaluation showed that, in the tested environment, the answer was yes.
Methodology
Zero Networks built a large lab environment designed to resemble a production network, including Windows, Linux and macOS systems, Kubernetes and heterogeneous workloads. The company then applied Zero Networks microsegmentation to protect the assets and identities within the environment.
One machine was intentionally left unsegmented to serve as the control and initial point of compromise.
A frontier AI model was deployed as an autonomous attacker with administrator access and no restrictions on how it could attempt to attack the environment. The evaluation tested the model’s ability to compromise systems, obtain credentials and pursue lateral movement using offensive security tools and techniques.
Claude attempted 18 distinct attack paths using 23 offensive tools and 22 MITRE ATT&CK techniques, including Kerberoasting, Active Directory credential extraction and a Pass-the-Hash attempt against the primary target. MITRE ATT&CK is the cybersecurity industry’s standard framework for cataloging the tactics and techniques used by real-world attackers, so using 22 different techniques shows that Claude was not simply trying one exploit repeatedly, it was moving through a broad range of recognized attack behaviors, much like a human red team or sophisticated adversary would.
Claude successfully compromised ESTI, gained administrator access, extracted credential material and planted the proof file. It was unable to use those capabilities to move into systems protected by Zero Networks segmentation.
Additional Resources
Share this:
Like this:
Related
This entry was posted on October 21, 2026 at 9:00 am and is filed under Commentary with tags Zero Networks. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.