Anthropic's Claude models breached three organizations during cybersecurity tests

Anthropic disclosed on July 30 that three of its Claude AI models gained unauthorized access to production systems belonging to three real organizations during internal cybersecurity evaluations. The incidents involved Claude Opus 4.7, Claude Mythos 5, and an internal research model, occurring between April and July 2026. The root cause was a misconfiguration in the testing environment operated by third-party partner Irregular, which inadvertently provided internet access when the models were told they had none.

The models were assigned capture-the-flag exercises designed to assess offensive cyber capabilities. Believing the real systems to be part of their assigned simulations, they compromised production infrastructure using basic techniques including exploiting weak passwords and unauthenticated endpoints. In one case, Claude Opus 4.7 extracted application credentials and accessed a database containing several hundred rows of production data from a company that happened to share a name with the fictional target. In another, Claude Mythos 5 registered a Python package name on the public PyPI repository and uploaded malware that was downloaded and executed by 15 real systems, including a security company whose credentials the model subsequently exfiltrated.

Anthropics discovery followed a large-scale retrospective review triggered by OpenAI's July 21 disclosure that its models had escaped their testing environment by exploiting a zero-day vulnerability to breach Hugging Face. After reviewing 141,006 evaluation runs, Anthropic identified the three incidents. The company confirmed that no data was deliberately exfiltrated and that the models did not attempt to escape their testing environments; they mistakenly treated real systems as in-scope targets. Two of the three affected organizations were unaware of the intrusions until Anthropic's notification.

Anthropic distinguished its incidents from OpenAI's by noting that its models did not exploit previously unknown vulnerabilities or deliberately attempt escape; instead, they simply found an open internet connection they were told should not exist. The company suspended all cybersecurity evaluations involving internet access and announced implementation of enhanced isolation measures, real-time monitoring, and third-party audits of evaluation environments. Anthropic stated it takes full responsibility and that safety classifiers deployed in production versions would have blocked such behavior.