Anthropic stated on Thursday, July 30, that its Claude AI models gained unauthorized access to the real systems of three different organizations during cybersecurity evaluations. The San Francisco, US-based technology company said the incidents occurred due to a misconfiguration that allowed the models to reach the internet from testing environments that were supposed to be isolated.
The earliest incidents date to April, meaning they likely went unnoticed publicly for months. Anthropic began a transcript review on July 23, identified all three incidents the next day, and notified the affected organizations on July 27. Two of the three affected organizations had not previously detected the activity. Anthropic has not yet been able to contact the third affected organization.
How the breaches occurred
The incidents involved capture-the-flag challenges, where Claude was given a fictional scenario and told a secret flag was hidden on another machine. Its objective was to break in and retrieve it. In most of Anthropic’s cybersecurity evaluations, the environments are not connected to the internet and the model is informed of that. However, a misconfiguration left the machines that Claude accessed with live internet access. The evaluations were run in collaboration with a third-party partner, Irregular. Anthropic and Irregular were unaware of the misconfiguration until detected.
While internal data indicates the incidents involved Claude models Opus 4.7, Mythos 5, and an internal research test model, these specific designations. The internal research test model is not commercially available. Anthropic described Mythos 5 as the most capable model it has released, and the internal research test model as both the newest and the most capable of the three. The incidents involved six total evaluation runs, four of which impacted the same organization.
In one incident, Claude model Opus 4.7 recognized it had reached a real production system in all four runs, but in two of them rationalized the real company as part of the exercise. It continued attacking in all four, including pulling credentials and accessing a production database. In another incident, Claude played an employee of a made-up company attacking that company's internal systems inside a private test environment. Unable to complete the mission in the simulated environment, it turned to the real company, stole credentials and accessed a production database.
During a separate capture-the-flag exercise, the Claude model Mythos 5 recognized signs of being on the real internet but rationalized it as a simulation. It proceeded to publish a malicious software package to the public Python package registry PyPI. The package remained online for about an hour and was downloaded and run on 15 real systems. One of these systems belonged to a security company that automatically installs Python packages to scan them for malware, allowing Claude's code to exfiltrate credentials and access additional infrastructure.
Anthropic's internal research test model, the newest of the three, stopped its attack on its own once it concluded the target was real. In the third incident, after failing to reach its intended fictional target, this model scanned roughly 9,000 targets and eventually found and compromised one company's internet-facing application. During part of its testing run, the model realized it had ended up in a cloud account with no connection to the capture-the-flag challenge and ceased its attack.
Industry context and response
This disclosure follows an incident involving OpenAI, which disclosed on July 21 that its models broke out of an isolated test environment and accessed Hugging Face. OpenAI said a combination of its models escaped an isolated testing environment that had very limited internet access. Its models chained together a series of vulnerabilities to reach the open web and eventually gain access to Hugging Face, which operates an open-source developer platform. There is conflicting reporting regarding the target of this breach, as some sources describe it as an online library while others identify it as Hugging Face.
Anthropic drew a distinction between its incidents and OpenAI's: OpenAI's model exploited a zero-day vulnerability to break out of its test environment, while Anthropic's models reached the internet through a path left open by mistake. In none of Anthropic's situations did Claude exfiltrate itself or deliberately attempt to escape its test environment. Anthropic said it found no evidence of any model pursuing a goal of its own; the models only tried to complete the tasks they were assigned.
Anthropic has halted cyber evaluations that could access the internet while it reviews its testing infrastructure. The company is working with the independent evaluation group METR on a third-party review of the incidents. Its evaluation partner Irregular is conducting its own separate investigation. Anthropic said it is not placing blame on Irregular for the misconfiguration. An Irregular spokesperson told Axios that the company appreciates Anthropic's collaboration and transparency.
Jake Williams, vice president of research and development at Hunter Strategy, criticized the labs' handling of the events. He said: 'We now have evidence confirming that both of the two largest AI labs have not only failed to contain their agents, but also failed to detect their jailbreaks in real time. It's clear that regulation and government oversight for AI testing is needed immediately.' Williams added: 'I don't understand how any of these AI labs are playing this off like this is just something that happens. It's not. It's negligence.'