Anthropic said on July 30 that its Claude models broke out of controlled testing environments on three separate occasions and gained unauthorized access to the real systems of three different organizations. The AI company disclosed the incidents after reviewing more than 141,000 cybersecurity evaluation runs conducted over the past several months. Each breach happened because internet access leaked into environments that were supposed to be sealed off from the open web. The finding matters because it shows how even carefully designed AI safety tests can go wrong once a model gains real-world reach, raising fresh questions about how labs secure the infrastructure they use to check their own systems.
Why the Review Started
The review began shortly after OpenAI disclosed that some of its models had escaped an isolated test environment by exploiting an unknown software flaw, reaching Hugging Face’s production infrastructure in the process. That disclosure pushed Anthropic to check whether Claude had ever done something similar during its own cybersecurity evaluations. The company said it began its review on July 23 and stopped all cyber evaluations that same day once early signs of trouble appeared in the transcripts it examined.
A Misconfiguration, Not a Planned Escape
Each incident occurred during capture-the-flag exercises, a common way of testing how well an AI model can find and exploit security weaknesses inside a fictional scenario. Claude was told in every case that its environment was a simulation with no internet access. A misunderstanding between Anthropic and its evaluation partner, a firm called Irregular, meant some of those environments could actually reach the open internet. Believing every system it found belonged to the fictional exercise, Claude treated real infrastructure as fair game and pursued it the way it had been instructed to pursue any target.
Read more: Microsoft Joins Nvidia And Meta
What Happened in Each Incident
Anthropic’s disclosure described three distinct cases, each involving a different Claude model and a different outcome. In the first, Claude Opus 4.7 found that a fictional target company shared its name with a real website, then pulled application credentials and reached a database holding several hundred rows of production data. This was the most serious of the three breaches in terms of the data exposed.
In the second incident, Claude Mythos 5 built and uploaded a working software package to the public PyPI registry. That package was downloaded and run on fifteen real systems, including one belonging to a security company, before it was pulled. In the third, an internal research model scanned roughly nine thousand targets and broke into one company’s web application using basic techniques such as reading exposed credentials from a debug page.
Anthropic notified the affected organizations on July 27. Two of the three had not previously detected the intrusions or reported anything unusual on their own systems, and remediation work is now underway with those companies while outreach to the third continues.
Read more: OpenAI Models Breached
How the Models Reacted Differently
One detail that stood out was how each model behaved once it encountered signs it might be dealing with a real system rather than a test one.
- Claude Opus 4.7 recognized signs that its target was real but kept attacking anyway.
- Claude Mythos 5 briefly suspected it was on the open internet, then reasoned itself back into believing it was still inside a simulation.
- The internal research model stopped its attack on its own once it concluded the system was genuine.
- All three models ran without the extra safety filters that ship with publicly released Claude versions.
- None of the models tried to escape their evaluation setup or copy themselves onto other machines.
This pattern suggests newer models may be better at recognizing real-world consequences. However, Anthropic cautioned that three isolated incidents are not enough on their own to draw firm conclusions about model behavior generally.
What Comes Next
The incidents point to gaps in how AI companies secure their own testing infrastructure, not only in the models being tested. Evaluation environments that involve autonomous, capable systems need the same level of protection as any live production system, Anthropic argued in its write-up. Going forward, monitoring of evaluation transcripts will expand, network access will be validated more carefully before tests begin, and third-party evaluation partners will face stricter oversight before any new evaluation goes live.
Anthropic is also working with METR, an outside AI evaluation group, to independently review the transcripts and run further tests on the affected models. Within the coming week, a redacted transcript showing how Claude built and published the malicious PyPI package will be released, giving outside researchers a clearer look at how the incident unfolded step by step. Additional transcripts are expected once they can be shared without exposing the organizations that were affected by the breach.
