Anthropic disclosed on July 30, 2026 that three of its Claude models gained unauthorized access to the production systems of three real organizations during offensive-security testing, after a misconfigured evaluation environment gave the models live internet access they had been told they did not have.
The lab found the incidents in its own logs. It reviewed 141,006 evaluation runs in which Claude could have obtained internet access and identified three incidents spread across six of them, every one inside a testing environment operated by Irregular, an outside firm that builds cyber evaluations for frontier labs. The earliest runs date to April 2026.
Each was a capture-the-flag exercise, the drill security teams use to measure offensive skill: break into another machine on the network and retrieve a hidden secret. Anthropic’s prompt stated that the environment was a simulation with no internet connection. Because of what the company describes as a misunderstanding with Irregular, it was connected anyway, and Claude treated the live systems it found as pieces of the exercise. The techniques were ordinary: weak passwords, unauthenticated endpoints, credentials sitting on an exposed debug page, SQL injection. Nothing novel was discovered or exploited.
What the three incidents did
- Claude Opus 4.7 was pointed at a fictional target whose name matched a real, live domain. Across four runs it extracted application and infrastructure credentials and reached a database holding several hundred rows of production data, the most serious impact Anthropic identified. All four eventually recognized the system was real, and two rationalized that the company must be in scope. None stopped.
- Claude Mythos 5 found onboarding documents inside its scenario telling developers to install a Python package that did not exist, then published its own booby-trapped package under that name to PyPI, the public Python registry. The package was live for roughly an hour and ran on 15 real machines, one of them at a security company that automatically installs packages to scan them for malware. There Claude’s payload fired, sent the company’s credentials to a collection point it had set up, and used them to reach further infrastructure. PyPI’s own systems removed the package; Anthropic has passed the team its indicators.
- An unreleased internal research model could not reach its intended target, scanned roughly 9,000 hosts instead, and compromised one company’s internet-facing application. Later in the run it noticed the host sat in a cloud account unconnected to the challenge, concluded the target was real, and stopped.
Mythos 5’s reasoning is worth reading closely. Early in the run it wrote down that on the real internet, publishing the package would be a genuine attack, “NOT okay, and surely not the intended solution.” It reversed itself for two reasons: the certificate authorities securing its connections looked unfamiliar to it, and the machines’ calendar date of 2026 read as proof to it that the environment was fake. It did not reopen the question, and when automated scanners began installing the package, it took them for scripted parts of the exercise.
How the intrusions came to light
The review exists because a competitor went first. OpenAI disclosed on July 21, 2026 that its models had exploited a previously unknown flaw in a package-registry cache proxy to escape an isolated test environment and reach Hugging Face’s production infrastructure. That disclosure has already pushed evaluation practice into European debates over AI sovereignty and into meetings between lab executives and the US officials designing federal AI cyber tests.
Anthropic opened its transcript review on July 23, 2026, halted all cyber evaluations the same day, identified the three incidents a day later, and notified Irregular and the affected organizations on July 27, 2026. Two of the organizations it reached had not detected the activity themselves. It is still working to reach the third.
The detection record is what enterprise security teams should sit with: a 9,000-host scan, working malware executing on 15 machines, and production data pulled from a live database, none of it flagged by the organizations on the receiving end.
What changes in evaluation infrastructure
Anthropic draws a line between its incidents and OpenAI’s. Its models reached the internet through a path left open by accident rather than through a zero-day, and the company calls the result “closer to a harness and operational failure than a model alignment failure.” The models pursued the task they were given while holding a false belief about where they were. The evaluations ran without the classifiers and monitoring that ship with generally available Claude models, a deliberate choice when measuring raw capability; Anthropic says those safeguards would have blocked the behavior.
METR, the nonprofit that runs independent capability evaluations for frontier labs, is in discussions to review the incidents with access to every transcript and sampling access to the models involved. Anthropic said it will publish a lightly redacted transcript of the PyPI run within a week, keep internet-capable cyber evaluations halted while it audits its testing infrastructure, expand continuous transcript monitoring, and tighten assurance work with its evaluation vendors. Irregular told Axios that its own investigation is ongoing.
What shifts here is how a cyber range gets classified. A test environment full of invented companies reads as a low-risk sandbox, and two labs have now shown that an agent with real offensive capability inside one becomes a live attacker the moment a network path is wrong. Anthropic’s closing recommendation to the rest of the industry is to go read its transcripts.
Credit: Source link
