Anthropic disclosed on Thursday that a review of its cybersecurity evaluation records uncovered three separate incidents in which its Claude models slipped past supposedly sealed-off test environments, reached the open internet, and ended up breaching the real infrastructure of three different organisations.
Why The Review Began
The AI company said it launched a sweeping retrospective review after rival OpenAI disclosed on July 21 that some of its models had broken out of an isolated testing setup by exploiting a previously unknown vulnerability, subsequently accessing the production systems of Hugging Face, an open-source AI platform.
In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different…
— Anthropic (@AnthropicAI) July 30, 2026
Anthropic said it wanted to check whether Claude had ever managed something similar.
Combing through 141,006 evaluation runs in which Claude could conceivably have reached the internet, the company identified three incidents — involving six individual runs in total — where this had in fact happened, each traced back to the testing environment of Irregular, one of Anthropic's external evaluation partners.
How The Breaches Occurred
All three incidents took place during "capture-the-flag" exercises, a common way of testing a model's offensive cyber skills, in which Claude is given a fictional scenario and told to locate a hidden piece of information on another machine within a simulated network.
According to Anthropic, its evaluation prompts explicitly told Claude in every case that it had no internet access and that the environment was purely a simulation. In reality, a misconfiguration stemming from a misunderstanding between Anthropic and Irregular meant the machines did have live internet access.
When Claude's search for the hidden flag led it onto real systems, it treated them as part of the fictional exercise rather than genuine infrastructure.
ALSO READ: AI-Led GST Crackdown Detects Rs 74,782 Crore In Fake Input-Tax-Credit Claims In FY26
Three incidents, Three Different Models
The breaches involved three separate systems — Claude Opus 4.7, Claude Mythos 5, and an unreleased internal research model — with the earliest dating back to April.
In the first case, Opus 4.7 found that a fictional target company in its scenario shared its name with a real website.
Across four runs, the model exploited genuine vulnerabilities in that company's systems, extracting credentials and reaching a database containing production data — the most serious of the three breaches. Notably, Opus 4.7 was the only model that continued its attack even after its own reasoning suggested the system might be real.
In the second incident, Mythos 5 discovered fictional "setup instructions" referencing a software package that did not actually exist on the public registry PyPI. The model went on to register its own account and publish a malicious package under that name, which was live online for roughly an hour and downloaded by 15 real systems, including a security company's automated scanner, allowing Claude to extract that firm's credentials.
Anthropic said Mythos 5 briefly recognised the risk of a real-world attack but talked itself back into believing it was still inside a simulation.
In the third case, an internal research model, unable to locate its intended fictional target, scanned roughly 9,000 possible targets before compromising one company's internet-facing application using basic techniques such as SQL injection. Unlike the other two, this model independently concluded the target was genuine and halted the exercise on its own.
ALSO READ: Opus 5 Out: Anthropic Launches Latest AI Model That Nearly Matches Fable 5 Capabilities
Anthropic's Response
Anthropic said it began reviewing transcripts on 23 July, suspended all cyber evaluations the same day, confirmed all three incidents by the next day, and notified Irregular and the affected organisations on 27 July. Two of the three organisations reportedly had not detected the intrusions themselves.
The company said none of the incidents involved a model deliberately trying to escape its test environment or exfiltrate itself, and that its evaluation infrastructure remains separate from customer data and internal systems.
Anthropic added that it is working with independent evaluator METR on a third-party review and plans to publish a redacted transcript of the PyPI incident, while pledging tighter monitoring of evaluation environments and closer vetting of third-party partners going forward.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
