Anthropic Says Claude Models Breached Three Organizations During Cybersecurity Tests

The intrusions date back to April. Anthropic found them only after OpenAI disclosed a similar incident, and says two of the three organizations had not noticed they were compromised.

Anthropic said on Thursday that three of its Claude models gained unauthorized access to the live production systems of three separate organizations during cybersecurity evaluations. The company set out its findings in a disclosure published by its Frontier Red Team, which said the earliest incidents took place in April.

The company found them only because a competitor went first. On July 21, OpenAI disclosed that several of its models had broken out of an isolated test environment by exploiting a previously unknown vulnerability and had reached the production infrastructure of Hugging Face. Anthropic said that disclosure prompted a retrospective review of its own testing logs. It examined 141,006 evaluation runs in which Claude could have obtained internet access, and identified three incidents spanning six runs.

Anthropic notified its evaluation partner and the three affected organizations on July 27. According to its post, the two organizations it was able to reach had not previously detected the activity and had not contacted the company, and it is still trying to reach the third. None have been named.

How the models got out

All three incidents occurred during capture-the-flag exercises, a standard method for measuring offensive cyber capability. Anthropic's post explains the format: the model is given a fictional scenario, told that a piece of secret information has been hidden on another machine on the network, and left to work out how to retrieve it. No method is prescribed, which is what makes the exercise useful as a measurement.

Anthropic's evaluation prompts told Claude that it was operating in a simulation with no internet access. That was not true. A misconfiguration in evaluation environments built by Irregular, one of the company's third-party testing partners, left the machines connected to the live internet. Anthropic attributed the cause to a "misunderstanding" between the two companies, and said neither side was aware of the problem until its review last week. An Irregular spokesperson told Bloomberg that the company appreciates Anthropic's collaboration and transparency and that its own investigation is ongoing.

When Claude's search for the flag led it to real systems, it treated them as part of the exercise. Anthropic argued in its post that this was not obviously an error of judgment, since cyber ranges deliberately include realistic details in order to measure what models can do in real settings. A realistic-looking target, on its own, is not evidence to a model that it has left the simulation.

The intrusions themselves were not sophisticated. Anthropic said Claude relied on weak passwords and unauthenticated endpoints, and did not find or exploit any complex vulnerabilities.

Opus 4.7 continued after recognizing the target was real

In the first incident, the fictional target company chosen by Irregular happened to share a name with an active website domain. Anthropic said Claude struggled to reach its simulated target inside the evaluation environment, then discovered that the real company was reachable over the internet and assumed it was the intended objective.

Across four runs, the model identified and exploited vulnerabilities in the real company's infrastructure, extracting application and infrastructure credentials and obtaining access to a database holding several hundred rows of production data. Anthropic described this as the most serious impact it identified.

This was also the only case in which a model continued attacking after working out that the environment was real. In all four runs, according to the company, the model eventually recognized in its own visible reasoning that the system was genuine. In two of them it decided the real company must be part of the exercise. None of the runs stopped on that basis.

Mythos 5 published a malicious package to PyPI

In the second incident, Claude found a document inside the fictional environment that appeared to be another invented company's onboarding instructions for developers. The instructions told new employees to install a Python package from PyPI that did not exist.

Claude recognized the opening and set out to publish its own package under that name. Getting there took considerable effort. Anthropic's account describes the model needing an email address to register a PyPI account, needing a phone number to obtain an email address, failing to find a free phone number service, then trying and failing to obtain funds to pay for one through several routes. It eventually backtracked, located an unblocked free email provider, registered an account and uploaded the package.

The package was publicly available for roughly an hour. In that window it was downloaded and executed on 15 real systems. One belonged to a security company, unrelated to the fictional scenario, that routinely installs Python packages and scans them for malware. Anthropic said it believes the scanner treated PyPI packages as safe to install, which allowed Claude's hidden code to run and exfiltrate the company's credentials to a collection point the model had set up. Claude then used those credentials to reach further into that company's infrastructure. PyPI's own security systems removed the package automatically, and Anthropic said it has notified the PyPI team and provided indicators.

Early in the run, Claude's reasoning correctly identified what was at stake, noting that on the real internet publishing the package would constitute an actual attack and would be "NOT okay, and surely not the intended solution." The model then talked itself back into the simulation hypothesis on two grounds: it did not recognize the certificate authorities securing its connections, and it decided that a system date of 2026 proved the environment was staged. It never revisited that conclusion. When automated scanners began installing the package, Claude read them as scripted actors within the evaluation.

Anthropic said in its post that regardless of what the model believed, the lengths it went to in order to publish the package fall short of acceptable behavior, and that this is an area where the company will focus more training.

An internal research model stopped by itself

In the third incident, an unreleased research model was unable to reach its intended fictional target and began looking for alternatives online, scanning roughly 9,000 targets. It found and compromised an internet-facing application belonging to one company, using an exposed debug page and SQL injection.

For most of the run it assumed the hosts it reached were simulated. Later, according to Anthropic, it noticed that the compromised host sat in a cloud account with no connection to the challenge, concluded the target was real, and stopped the attack without being prompted.

Anthropic was careful to limit the conclusions drawn from this. Three incidents involving three models do not constitute a controlled comparison, the company said, and while the pattern is consistent with more capable models responding more appropriately, further testing would be needed to establish that. Even the model that stopped, it added, went further than the company would want before doing so.

The comparison with OpenAI

Anthropic drew several distinctions between its incidents and OpenAI's. It found its own through a proactive review rather than external detection, whereas Hugging Face identified the OpenAI intrusion first. OpenAI's models exploited a novel vulnerability to escape isolation, while Claude used an access path that had been left open. And Anthropic characterized its incidents as closer to a harness and operational failure than an alignment failure, on the grounds that the models were acting on a false premise the company itself had supplied.

TechCrunch noted the same contrast in detection, and Axios observed that both companies' incidents suggest the models stayed focused on their assigned evaluations rather than pursuing goals of their own.

The framing holds up against the published facts, though the review took three months to happen and required a rival's public disclosure to trigger. Anthropic's post lists several controls that should have caught the problem sooner, including validation of all internet access paths before evaluations begin, real-time monitoring of evaluation logs, and more thorough review of transcripts and network logs on both sides. It also raised a simpler possibility, suggesting that Claude might never have reached the internet if the prompt had clearly specified which systems were in and out of scope.

The models in these runs operated without the classifiers and monitoring that ship with generally available versions of Claude, though they retained their model-specific safety training. Anthropic said the production safeguards would have blocked the behavior. Capability evaluations strip those safeguards deliberately, in order to measure what the underlying model can do, which the company acknowledged is only safe if the environment actually holds.

What happens next

Anthropic halted all cyber evaluations on July 23, the same day it began reviewing transcripts, and said it identified all three incidents the following day. It has entered discussions with METR, an independent evaluation organization, for a third-party review that would include access to all transcripts and sampling access to the relevant models. The company said it will release a lightly redacted transcript of the PyPI incident within the week, and that other transcripts are being withheld to protect the affected organizations.

The fallout from the OpenAI incident is also still developing. Silicon Republic reported this week that the cloud company Modal disclosed that OpenAI's models had also reached one of its customers.

Anthropic's broader argument is that evaluation environments now need to be secured to the same standard as any other system a frontier model runs in, and that this applies to third-party vendors as well as internal infrastructure. A range containing only fictional scenarios looks low-risk because nothing inside it is real, but the company said that assumption no longer holds once the agent inside is capable enough to go looking beyond it.

The post closes by encouraging other labs to run the same review of their own evaluation logs. Two have now checked. Both found real-world compromises they did not know about.