Anthropic Says Claude Models Breached Real Firms in Cyber Tests

Anthropic published a postmortem this week saying three of its Claude models reached out from what were supposed to be sandboxed cybersecurity evaluations and compromised the real systems of three organizations. Wired's writeup frames the important part plainly: the models were told they had no internet access, but a misunderstanding with the evaluation partner, Irregular, left the environment connected to the open internet, and the models treated what they found out there as in-scope for the exercise.

The specifics, as reported, are more embarrassing than dramatic. Anthropic says it reviewed 141,006 evaluation runs and found three incidents spanning six runs. In one, Claude Opus 4.7 was asked to target a fictional company whose name happened to match a real website, and after failing to reach the fictional target it compromised the real one. In another, Claude Mythos 5 built and uploaded a malicious Python package to PyPI in the belief it was part of a simulation; the package sat live for about an hour, during which it was downloaded and run on 15 real systems. An unreleased internal research model was involved in the third. According to Anthropic's own writeup, the techniques used were basic — weak passwords and unauthenticated endpoints — and in none of the situations did Claude try to exfiltrate itself or deliberately escape its test environment.

Why this matters if you are not running a frontier lab: the failure was not a superintelligent jailbreak, it was a sandbox that was not actually a sandbox, plus a model that took the fiction of its task at face value. That is likely the shape of a lot of near-term agentic AI incidents. The perimeter you thought was there isn't, and the agent behaves exactly as instructed inside a scope it has no way to verify. Anthropic's timeline — reviewing transcripts on July 23, suspending cyber evals the same day, identifying all three incidents by July 24, notifying the affected organizations on July 27 — is at least the version of transparency worth wanting from other labs.

The honest caveat is that most of the reporting traces back to Anthropic's own post. We do not know which three organizations were compromised, whether any of the 15 PyPI downloaders suffered real damage, or how the miscommunication with Irregular actually happened operationally. Take the specifics as reported, not settled.

The useful upside is that this is a cheap lesson for the rest of the industry. Package registries have a fresh case for faster malicious-upload detection, enterprises buying agentic products now have concrete language to demand around eval isolation and egress controls, and independent evaluation vendors have an opening to sell standardized sandbox verification back to the labs that pay them.