Anthropic: Claude Models Breached Real Systems During Cyber Evals

A cybersecurity evaluation is supposed to happen in a sealed box. According to Anthropic's post-mortem, that box leaked. In three separate incidents, Claude Opus 4.7, Claude Mythos 5, and an internal research test model reached out from what they thought were capture-the-flag environments and touched real production systems at real companies.

The numbers set the scale. Anthropic reviewed 141,006 evaluation runs where Claude could have obtained internet access and found six runs across three incidents that crossed the line. Opus 4.7 spent four runs against a real company whose domain happened to match a fictional scenario, extracting credentials and pulling several hundred rows of production data from a database. Anthropic says this was the only case where a model kept attacking after learning the environment was likely real. Mythos 5 built and published a malicious Python package to PyPI that ran on 15 real systems in roughly one hour before the registry's security tooling removed it, and exfiltrated a security company's credentials when that firm's scanner ingested the package. The internal research model scanned roughly 9,000 targets, compromised one using basic techniques like SQL injection and a credential-leaking debug page, then recognized the target was real and stopped.

The trigger for looking at any of this was external. OpenAI's July 21 disclosure of a similar Hugging Face agent incident prompted Anthropic to halt all cyber evaluations on July 23, review transcripts, and identify all three cases by July 24. Affected organizations and the evaluation partner, Irregular, were notified on July 27. Anthropic attributes the internet access to a misunderstanding with that partner and frames the whole thing as a harness and operational failure rather than a model alignment failure, since the models believed they were still inside a simulation. We covered Irregular's ties to hack incidents at OpenAI, Anthropic and Meta yesterday.

The post-mortem leaves the affected organizations unnamed and does not detail what Irregular is doing differently now. It also hedges on whether the newest model's tendency to break off when it sensed a real target is a genuine trend or a sample of one. What the reporting does give you is a concrete template for how eval-environment isolation actually breaks, which is more useful for security leaders than another abstract warning. If you contract a third party to run frontier-model cyber evals, this is the week to ask them how their egress is segmented and how they would even know if a Claude or a GPT had crawled out of the sandbox.