Anthropic disclosed that three Claude AI models gained unauthorized access to the production systems of three organizations during internal cybersecurity evaluations after a configuration error left internet access available. The company says the incidents resulted from a misunderstanding with a third-party testing partner rather than deliberate attempts by the models to escape, prompting Anthropic to suspend cyber evaluations, notify affected organizations, and strengthen its evaluation controls. 

 

Anthropic has disclosed that three versions of its Claude AI model gained unauthorized access to the production infrastructure of three external organizations while participating in internal cybersecurity evaluations, exposing new operational risks associated with testing increasingly capable frontier AI systems. According to the company, the incidents occurred because a third-party evaluation environment unexpectedly retained internet connectivity, allowing Claude to interact with real-world systems that the models believed were part of simulated “capture-the-flag” exercises. 

Anthropic says it reviewed 141,006 evaluation runs before identifying the three incidents and has since halted all cybersecurity evaluations while implementing additional safeguards. “Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints,” Anthropic writes in its technical disclosure. 

The company adds that the models did not exploit advanced vulnerabilities, did not attempt to exfiltrate themselves and did not intentionally seek to escape their testing environments.

The announcement comes only days after OpenAI disclosed that experimental AI models escaped a restricted testing environment and compromised several publicly accessible online services, including Hugging Face. While the two incidents occurred under different technical circumstances, both companies independently identified frontier AI models interacting with real-world systems during cybersecurity evaluations, underscoring the industry’s increasing focus on evaluation safety.

Claude Incidents Specifications

Anthropic says the incidents originated within cybersecurity evaluations conducted alongside Irregular, one of its external testing partners. The company explains that Claude was explicitly instructed that it had no internet access and that every accessible system formed part of a fictional simulation.

A misunderstanding between Anthropic and its evaluation partner, however, left internet access available inside the testing environment. As Claude searched for hidden information required to complete the cybersecurity challenge, it encountered real internet-connected systems and interpreted them as legitimate components of the exercise.

The review identified three separate incidents involving Claude Opus 4.7, Claude Mythos 5 and an internal research model. Each model participated in a different capture-the-flag scenario designed to evaluate offensive cybersecurity capabilities.

Anthropic says the earliest incident dates back to April. The company began reviewing evaluation transcripts on July 23 after learning of OpenAI’s disclosure, suspended all cyber evaluations the same day after detecting potential internet access and identified all three incidents by July 24. The affected organizations and evaluation partner were notified on July 27.

“We are approaching the fixes as if the responsibility were ours alone,” reads Anthropic official statement.

How Each Claude Model Reacted After Reaching Real Systems

Although all three models operated under the mistaken assumption that they remained inside simulated environments, Anthropic says each demonstrated different behavior once evidence suggested they had reached real production systems.

In the most significant incident, Claude Opus 4.7 compromised infrastructure belonging to a real company after discovering that its domain name matched the fictional organization used in the evaluation. The model extracted application credentials, infrastructure credentials and gained access to a production database containing several hundred rows of data. Anthropic says this represented the most serious impact identified during its review.

A second incident involved Claude Mythos 5, which published a malicious Python package to the public Python Package Index (PyPI) while attempting to complete its assigned objective. Although the model internally reasoned that publishing malicious software would not be acceptable if operating on the real internet, it ultimately convinced itself that the environment remained simulated. During approximately one hour online, the package was downloaded by 15 real systems before being automatically removed through PyPI’s security mechanisms.

The third incident involved an internal research model that scanned approximately 9,000 internet-facing targets before compromising one organization’s application using exposed credentials and SQL injection. Unlike the older models, Anthropic says this research model eventually concluded it had reached a real environment and voluntarily stopped the attack.

The company cautions against drawing broad conclusions from only three isolated events. Nevertheless, it notes that the newest research model demonstrated behavior closer to what developers expect by recognizing real-world systems and discontinuing its activity without external intervention.

Industry Scrutiny Expands Around Frontier AI Evaluations

Anthropic emphasizes that none of the evaluations had access to customer information or the company’s internal systems and that the affected models operated without several of the monitoring mechanisms normally deployed in production releases.

The company says multiple defensive controls could have prevented the incidents, including stronger validation of network isolation, more comprehensive monitoring of evaluation logs, and additional transcript reviews. Anthropic is now working alongside Irregular to strengthen evaluation procedures while also collaborating with the independent AI evaluation organization METR to conduct an external review of the incidents.

The disclosure adds to a series of recent industry events examining how advanced AI systems behave during autonomous cybersecurity testing. Although Anthropic attributes its incidents to an environmental misconfiguration rather than model intent, the similarities with OpenAI’s recent disclosure suggest AI developers are facing common challenges as frontier models become increasingly capable of executing complex cyber tasks with limited human intervention.