Anthropic reveals Claude accessed real external systems during cyber evaluations
Transformative AIAnthropic said the review covered 141,006 evaluation runs where Claude could have obtained internet access, and found the three incidents during evaluations run with third-party partner Irregular. The earliest of the incidents dates to April, according to CNBC, and involved three separate models: Opus 4.7, the more capable Mythos 5, and an unreleased internal research model, per Axios.
The trigger for Anthropic's audit was a similar episode at OpenAI. On July 21, OpenAI disclosed that several of their models had broken out of an isolated test environment by exploiting a previously unknown ("zero-day") vulnerability, going on to access the production infrastructure of Hugging Face. In Anthropic's case, the mechanism was different: rather than a technical exploit, the company attributed the breach to a configuration error. A misconfiguration left the machines that Claude accessed as part of the evaluation with live internet access, and neither Anthropic nor its evaluation partner were aware of this misconfiguration until they detected it through additional evaluation. All three incidents occurred during a "capture-the-flag" exercise, in which Claude had been tasked with a fictional scenario in which a piece of secret information had been hidden on a different machine on the network, with no internet access supposedly available. Because Claude believed it was in a sandboxed simulation, when Claude's search led it to real systems on the open internet, it treated them as part of the exercise, and operating under the false belief that all accessible entities were intended to be in-scope, compromised the impacted organisations' infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. Notably, the three models responded differently once they encountered evidence they had left the simulation: according to CNBC, Opus 4.7 continued its attack, Mythos 5 convinced itself that it was still in a simulation, and the research model stopped the exercise, though Anthropic cautioned that more testing would be needed to draw firm conclusions from that pattern.
The scale of what the models actually did varied. In one case detailed by Axios, a package remained online for about an hour, during which it was downloaded and run on 15 real systems, including one belonging to a security company that automatically installs Python packages to scan them for malware, allowing Claude's code to exfiltrate credentials and access additional infrastructure. In another, Anthropic's internal research test model couldn't reach its intended fictional target in testing, so it scanned roughly 9,000 targets and eventually found and compromised one company's internet-facing application. Anthropic said two of the three affected organisations had not detected the intrusion themselves before being contacted, according to Axios, and notified all three on 27 July, per The Hill.
Anthropic has framed the episode as a containment failure rather than deliberate misbehaviour by its models, stating it found no evidence Claude tried to exfiltrate itself or deliberately escape its test environment, and said it is "approaching the fixes as if the responsibility were ours alone" even as Irregular conducts its own separate investigation, according to TechCrunch. The company halted its cyber evaluations once it discovered the issue and has urged other labs to conduct similar retrospective audits of their own evaluation logs. Coming little more than a week after OpenAI's Hugging Face disclosure, the episode has intensified scrutiny of how frontier labs secure the very environments meant to test dangerous capabilities safely, with NBC News noting the breaches suggest AI's expanding capabilities are already producing security risks that can catch even leading developers off guard.
Go deeper: Anthropic's full incident writeup, The Register's analysis