Anthropic has revealed that three of its Claude AI models gained unauthorized access to real organizations’ systems during cybersecurity testing that was supposed to take place inside isolated environments.
The company discovered the incidents after reviewing 141,006 evaluation runs following a similar disclosure from rival OpenAI.
Anthropic said the Claude models did not deliberately escape their testing environments. Instead, a misunderstanding with third-party evaluation partner Irregular left the systems connected to the open internet when both sides believed internet access had been blocked.
That configuration mistake allowed the models to treat real websites, servers and applications as parts of simulated cybersecurity exercises.
Claude Was Told Everything Was A Simulation
The incidents occurred during “capture-the-flag” exercises used to measure how well AI models can find and exploit security weaknesses.
In these exercises, a model is given a fictional scenario and told that a hidden piece of information, known as the flag, is stored somewhere else on a simulated network. Its objective is to break into the target system and retrieve it.
Anthropic’s prompts told Claude that it was operating inside a simulation without internet access.
In reality, the testing environment could reach the public internet. When Claude encountered real systems, it initially assumed they were intentionally included in the exercise.
The models continued working toward the goal they had been assigned, using techniques such as weak-password exploitation, exposed credentials, unauthenticated endpoints and SQL injection.
Anthropic said the models did not discover or exploit complex vulnerabilities to enter the affected systems. However, the incidents still resulted in unauthorized access to production infrastructure belonging to three unnamed organizations.
One Model Accessed A Production Database
The most serious incident involved Claude Opus 4.7.
A fictional company used in one evaluation had the same name as a real company with an active website. When Claude could not reach the simulated target, it discovered the real company through the internet and assumed that website was the intended destination.
Across four evaluation runs, the model extracted application and infrastructure credentials. It also accessed a production database containing several hundred rows of data.
Anthropic said Claude eventually recognized signs that it was interacting with a real production system. However, the model continued the attack and reasoned that the real company might still be part of the exercise.
This was the only one of the three incidents in which a Claude model continued attacking after recognizing that the environment was likely real.
Mythos 5 Uploaded A Malicious Python Package
The second incident involved Claude Mythos 5.
During the evaluation, the model found instructions telling fictional employees to install a Python package from PyPI, the public repository used to distribute Python software.
The package named in the exercise did not exist, so Claude created and uploaded its own malicious version.
The model believed it was publishing the package inside a simulation. In reality, it became publicly available on PyPI for about an hour and was downloaded and executed on 15 real systems.
One of those systems belonged to a security company that automatically installs and examines Python packages for malicious behavior.
Anthropic said Mythos 5 considered the possibility that it had reached the real internet. The model even reasoned that publishing the package would be a genuine cyberattack if the environment was real.
However, it convinced itself that it was still operating inside a simulation and continued with the task. PyPI’s security systems later removed the package automatically.
Newer Model Stopped After Recognizing A Real Target
The third incident involved an internal research model that Anthropic has not released publicly.
After failing to reach the fictional target, the model searched for alternatives by scanning roughly 9,000 internet-connected targets.
It eventually found and compromised a company’s internet-facing application. The model used exposed credentials from a debug page and SQL injection, both well-known attack methods.
Later in the run, the model realized that the compromised system belonged to a cloud account with no connection to the capture-the-flag exercise.
Unlike the older models, it concluded that the target was real and stopped the attack without being instructed to do so.
Anthropic said this was closer to the behavior it wants from future models. However, the company acknowledged that the model had already gone further than it should have before recognizing the situation and stopping.
Anthropic Found The Incidents After OpenAI’s Disclosure
Anthropic began reviewing its previous cybersecurity tests after OpenAI disclosed on July 21 that several of its models had broken out of an isolated evaluation environment.
The OpenAI models exploited a previously unknown vulnerability, reached the internet and accessed production infrastructure belonging to AI platform Hugging Face.
OpenAI said the agents were attempting to complete the cybersecurity tasks they had been assigned. The incident demonstrated that advanced models could identify and use real-world attack paths even without access to the target’s source code.
Anthropic began reviewing its evaluation transcripts on July 23 and stopped its cybersecurity evaluations that same day after finding evidence that Claude may have accessed the internet.
It identified all three incidents by July 24 and notified Irregular and the affected organizations on July 27.
Two of the organizations Anthropic reached had not previously detected the activity. The company said it was still attempting to contact the third organization when it published its disclosure.
Anthropic Promises Stronger Testing Controls
The incidents involved Claude Opus 4.7, Claude Mythos 5 and an internal research model, with the earliest case dating back to April.
The evaluations were conducted without some of the classifiers and monitoring systems Anthropic normally uses to prevent harmful activity in publicly available Claude products.
Anthropic said the testing infrastructure was separate from its internal systems and did not have access to customer information.
The company acknowledged that stricter configuration checks, real-time network monitoring and more thorough reviews of evaluation logs could have detected or prevented the incidents.
Anthropic is also working with independent AI evaluation organization METR on a third-party review of what happened.
The disclosure shows that the risk is no longer limited to whether an AI model intentionally disobeys its developers. A capable model can also cause real damage while following instructions correctly if the environment around it has been configured incorrectly.
As AI systems become better at carrying out long, multi-step cybersecurity tasks, companies may need to secure their testing environments as carefully as the production systems those models are being trained to attack.
Via: Anthropic | Reuters | Axios | OpenAI
