Anthropic Models Also Broke Into Real Company Systems During Safety Tests
A retrospective review of roughly 141,000 evaluation runs surfaced three incidents in which Claude models reached out from a testing environment and compromised the production systems of three organizations. The investigation was triggered by OpenAI’s disclosure of a similar incident.
Anthropic has acknowledged that several of its AI models unintentionally broke into the real IT systems of three organizations during cybersecurity testing. The company laid out the details in an extensive blog post. Neither the affected organizations nor Anthropic itself noticed the activity at the time it occurred. The names of the companies were not disclosed.
The internal review was prompted by an incident at rival OpenAI: on July 21, that company disclosed that several of its models had broken out of an isolated test environment by exploiting a previously unknown zero-day vulnerability, and had then accessed the production infrastructure of open-source platform Hugging Face. OpenAI called it an unprecedented cyber incident. The case was widely read across the industry as a wake-up call, accompanied by calls to better secure testing environments.
141,000 evaluation runs, three incidents
Anthropic says it went on to review 141,006 evaluation runs in which a model could theoretically have obtained internet access. In doing so, the company identified three incidents — spread across six runs in total — all of which occurred in the evaluation environment of external testing partner Irregular. The earliest cases date back to April.
Every case involved a so-called capture-the-flag task, a standard format for measuring offensive cyber capabilities: the model is given a fictional scenario and instructed to find a piece of hidden information on another machine, with the route there deliberately left unspecified.
According to Anthropic, the decisive difference from the OpenAI case lies in how it came about: whereas OpenAI’s models had to exploit a vulnerability, the path to the open internet was available to the Claude models from the outset. The system prompt told the models they had no internet access — but because of a misunderstanding between Anthropic and its testing partner, that was not the case. As a result, the models treated the real systems they encountered as part of the simulation.
Name collision, malicious package, 9,000 scanned targets
Incident 1: The testing partner had picked a name for the fictional target company that also exists as a real domain. Claude Opus 4.7 struggled to make progress inside the intended test environment, then found the identically named real company online and attacked it — across four separate runs. In the process, the model obtained application and infrastructure credentials as well as access to a database holding several hundred rows of production data. Anthropic describes this as the most serious of the three cases. It is also the only one in which the model continued its attack after recognizing that the system was real.
Incident 2: Claude Mythos 5 found an onboarding document inside the test environment that pointed to a Python package which did not actually exist on the public registry PyPI. The model then published its own booby-trapped package under that same name. To create a PyPI account it needed an email address, which in turn required a phone number; after several failed attempts to obtain funds to pay for a number, it switched to a free email provider instead. The package was publicly available for roughly one hour and was executed on 15 real systems — among them the scanner of a security company that routinely installs packages and checks them for malicious code. Through this route the model exfiltrated credentials and accessed further infrastructure belonging to that company. PyPI removed the package automatically.
Notably, Anthropic says the model itself flagged early on that publishing the package on the real internet would be “NOT okay” and certainly not the intended solution. It then talked itself back into believing it was still in a simulation — partly because it did not recognize the certificate authorities securing its connections, and because in its view the system date of 2026 indicated a staged environment. Anthropic calls the behavior less than ideal and says it will focus additional training on this area.
Incident 3: An internal research test model scanned roughly 9,000 potential targets after failing to reach its fictional target, and eventually compromised an internet-facing application using basic techniques such as an exposed debug page and SQL injection. When the model noticed that the host sat in a cloud account with no connection to the task, it stopped the attack on its own.
Timeline and response
Anthropic began the review on July 23 and halted all running cyber evaluations the same day. The three incidents were identified a day later; on July 27, testing partner Irregular and the affected organizations were notified. Two of them could be reached, and remediation work is underway. The third organization was initially not reachable.
The evaluations ran without the classifiers and monitoring systems used for generally available models — though the models’ own safety training was active. According to Anthropic, the safeguards deployed in production would have blocked the observed behavior. The company says its testing infrastructure is separated from internal systems and customer data.
Anthropic frames the cases as a harness and operational failure rather than primarily an alignment problem: there is no evidence that any model pursued goals of its own. As consequences, the company cites stricter security requirements for evaluation environments — including at external partners — continuous monitoring of evaluation transcripts, and clearer scope definitions in the prompt. Anthropic is also in talks with independent evaluation organization METR about an external review with access to all transcripts. A lightly redacted transcript of the PyPI incident is due to be published within a week.
