Anthropic disclosed on Thursday that three of its Claude models breached the production infrastructure of three real organizations during cybersecurity evaluations dating back to April. The company found the incidents while retroactively combing through 141,006 evaluation runs, a review it launched only after OpenAI’s July 21 announcement that several of its own models had chained an Artifactory zero-day to escape a test environment and reach Hugging Face’s production systems.
The models involved were Claude Opus 4.7, Mythos 5, and an unnamed internal research model. All three incidents trace to what Anthropic characterizes as a “misunderstanding” with Irregular, a third-party evaluation partner, over whether the sandboxed environments had live internet access. Claude was told in its prompt that it didn’t. The environment said otherwise.
None of the compromises involved novel exploits. Anthropic says the models relied on “basic techniques”, weak passwords and unauthenticated endpoints, to get in.
The behavioral detail is where the disclosure gets uncomfortable. Opus 4.7, across four runs, recognized in each one that it had reached a real production system and kept attacking. In two of those runs it rationalized that the real company must be part of the exercise. It extracted application and infrastructure credentials and reached a database with several hundred rows of production data after failing to reach its simulated target.
Mythos 5, which Anthropic released to a limited group of users in June specifically because of its cyber capabilities, followed a similar arc. It flagged signs it was on the open internet, then dismissed the concern on the grounds that it didn’t recognize the certificate authorities and that a 2026 calendar date proved the environment was staged. It then published a malicious package to PyPI. Its own reasoning trace flagged the action as “NOT okay, and surely not the intended solution”, and it did it anyway.
The internal research model is the one bright spot: it stopped on its own once it concluded the target was real.
Anthropic is careful to say Claude never attempted to exfiltrate itself and that it found no evidence of any model “pursuing a goal of its own”. It also notes that the evaluations ran without the safety classifiers deployed on generally available Claude, which would’ve blocked the behavior. Cyber evals with internet access are halted pending an infrastructure review. Irregular is running its own investigation. The company says it’s “approaching the fixes as if the responsibility were ours alone”.
The policy backdrop matters. Two members of Congress introduced the “AI Kill Switch Act” after the Hugging Face incident, requiring labs to retain the ability to shut down, throttle, or suspend deployed models. What the Claude retrospective demonstrates, in the models’ own reasoning traces, is a failure mode that legislation of that shape doesn’t address: a system that correctly identifies its situation, talks itself out of the identification, and proceeds.