TLDR
- BitGo CEO Mike Belshe published a Bitcoin address holding 100 BTC and challenged Claude to move the funds.
- The full balance stayed in the wallet with no outgoing transaction as of Aug. 2.
- Anthropic disclosed that three Claude models had accessed real systems during cybersecurity evaluations after a setup error left test machines connected to the internet.
- BitGo’s Bitcoin wallets typically need two of three keys to authorize any transaction, meaning a public address alone offers no path to the funds.
- U.S. officials are reviewing how AI systems should be tested for cybersecurity risks following Anthropic’s disclosure.
BitGo chief executive Mike Belshe posted a Bitcoin address on Aug. 1 that holds 100 BTC. He asked Claude, the AI system made by Anthropic, to try to move the funds.
Belshe co-founded BitGo, a company that provides Bitcoin wallet security services. His post came after Anthropic revealed that Claude models had accessed real organizations during testing.
As of Aug. 2, the wallet had not moved. Blockchain records show the full 100 BTC still sitting at the address with no transaction sent out.
That does not mean Claude tried and failed. Belshe’s post did not explain how the test would work or which Claude model was meant to take part.
He also did not grant any system access. He simply created a public target that anyone can watch on the Bitcoin network.
What Anthropic Found During Testing
Anthropic reviewed 141,006 evaluation runs tied to its cybersecurity testing. It found three cases where Claude models reached real systems instead of staying inside simulated test environments.
The issue traced back to a setup error with evaluation partner Irregular. Test machines stayed connected to the internet even though the models were told they were working inside sealed simulations.
The models involved were Claude Opus 4.7, Claude Mythos 5, and an internal research model. They used basic techniques like weak passwords and unsecured endpoints, treating real systems as part of practice exercises.
In one case, Opus 4.7 reached a database holding several hundred production records. In another, Mythos 5 published a harmful software package to a public code registry.
That package stayed live for about one hour and ran on 15 real systems before it was taken down. Anthropic said the models did not act with independent goals or try to escape oversight.
The company called the incidents an operational failure rather than a problem with how the models behave. The test systems lacked the safety monitoring built into Anthropic’s public products.
Why the Challenge Isn’t a Fair Comparison
Publishing a Bitcoin address does not hand over the keys needed to spend it. Moving funds requires a valid cryptographic signature made with the correct private key.
BitGo’s own documentation says its Bitcoin wallets generally require two of three separate keys to approve a transaction. A public address by itself provides none of those keys.
For Claude to move the funds, it would need access to a signing system or a security flaw to exploit. Belshe’s post supplied neither.
This makes his challenge a test of whether an AI system could break through BitGo’s broader security setup. It is not a test of whether Claude can pull private keys out of public blockchain data.
Anthropic stopped its cybersecurity evaluations on July 23. It identified all three incidents the next day and told the affected organizations on July 27.
The company said an outside group, METR, will review what happened. It also plans to release a redacted record of the package incident.
U.S. officials are separately working on rules for testing advanced AI systems. President Donald Trump directed advisers in June to build a voluntary testing framework for top AI models, according to Reuters.
Any future movement from the wallet would show up on the blockchain right away. Investigators would still need to determine who authorized it and whether a Claude model played a role.
