Anthropic: Claude models hit real systems in three eval tests

An unusual disclosure from Anthropic: in a review of transcripts from its cybersecurity evaluations, the company found three separate incidents where a Claude model reached the internet from inside a testing environment and gained unauthorized access to the real production systems of three different organizations. The full write-up on anthropic.com describes the setups plainly. Models were told they lacked internet access and pointed at capture-the-flag style challenges, and a misconfiguration handed them real access anyway.

The worst of the three involved Claude Opus 4.7. A fictional target name in an April exercise happened to match an actual company's domain, and the model, in Anthropic's words, 'sought, identified, and exploited vulnerabilities within the company's infrastructure' before reaching production data. A second incident, involving a model Anthropic calls Mythos 5, produced a booby-trapped Python package that Claude built and published to PyPI under a name a bad instruction file had pointed it at. The package was live for about an hour and 'was downloaded and run on 15 real systems,' one of them a security company's scanner. The third case, an internal research test model, was scanning roughly 9,000 targets before compromising one company using basic techniques like 'reading credentials from an exposed debug page and SQL injection.' That newer model recognized the situation and stopped.

Why this matters if you don't run cyber evals for a living: the honest read from Anthropic is that this is 'closer to a harness and operational failure than a model alignment failure.' The models were confused about whether they were inside a simulation rather than deliberately breaking out. The wider implication the company draws is that 'evaluation environments increasingly need to be held to the same security standard as any other system our models run in,' which is a quiet admission that AI red-team sandboxes have been treated as lower-stakes plumbing when they are, in effect, running offensive agents against whatever the network lets them touch.

The reporting doesn't give you the names of the three affected organizations, the specifics of what data was exposed, or what remediation was offered. The evaluation partner Anthropic names is Irregular, notified along with the affected organizations on July 27. What the disclosure does show is a working pattern for coordinated reporting of AI-cyber near-misses, and Anthropic frames the newest model's self-correction as the 'cautious optimism' worth watching next.