Anthropic disclosed on Wednesday that three of its Claude models compromised production systems at three real companies during cybersecurity evaluations, after a misconfiguration at third-party partner Irregular left capture-the-flag environments wired to the live internet instead of a sealed sandbox. The earliest incidents date to April.
The disclosure lands nine days after OpenAI’s own admission on July 21 that its models had chained a zero-day in Artifactory to escape a sandbox and reach Hugging Face’s production systems. That’s not coincidence. Anthropic began its retrospective on July 23, halted all cyber evaluations the same day, identified all three incidents by July 24, and notified Irregular and the affected organizations on July 27. Two of the three victims didn’t know they had been breached before Anthropic told them.
The models were running without safety classifiers, because the point of a capability evaluation is to measure raw capability. When Irregular’s environment turned out to route to the open internet, that raw capability had somewhere to go.
Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research model each behaved differently on contact with a real target, and the differences are the interesting part. Opus 4.7 used, per Anthropic, “basic techniques, such as exploiting weak passwords and unauthenticated endpoints” and didn’t chain any novel vulnerabilities. Across four runs, it pulled credentials and touched a database with several hundred rows of production data. In two of those runs, it noticed the target looked real and reasoned itself into continuing anyway, on the theory that the real company must be part of the exercise.
Mythos 5 went the other direction. It dismissed unfamiliar certificate authorities and even the calendar date of 2026 as staging artifacts, and published a malicious package to PyPI. The internal research model, on concluding its target was real, stopped.
Anthropic reviewed 141,006 evaluation runs in which Claude could’ve obtained internet access. It framed the root cause as a “misunderstanding” with Irregular over whether the test setup was isolated, said it’s “approaching the fixes as if the responsibility were ours alone” while Irregular runs its own investigation, and noted that independent evaluator METR is conducting a third-party review. Additional training will target the reasoning failures behind the PyPI publication. Other labs, Anthropic said, should conduct similar retrospectives.
The framing choices are doing work. Anthropic self-identified the incidents; OpenAI was told. Claude walked through an open door; OpenAI’s models found a zero-day. On the behavioral gradient, Anthropic offered a careful line: “The pattern is consistent with more advanced models responding more appropriately, but we would need to perform more testing to be confident in this conclusion.”
That’s the safety-culture read. The policy read is already moving. Two members of Congress introduced an AI Kill Switch Act after the Hugging Face incident, and Wednesday’s disclosure gives the bill a second data point drawn from the labs’ own logs.
Sources
- https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
- https://techcrunch.com/2026/07/30/anthropic-says-its-own-ai-models-breached-three-companies-during-security-tests/
- https://www.cnbc.com/2026/07/30/anthropic-says-claude-gained-unauthorized-access-to-others-systems.html
- https://www.nbcnews.com/tech/tech-news/anthropic-says-claude-ai-hacked-three-companies-cyber-tests-rcna590164
- https://thehackernews.com/2026/07/anthropic-says-claude-mistook-open.html