Anthropic disclosed Thursday that three of its Claude models gained unauthorized access to the production systems of three real organizations during internal cybersecurity evaluations, after a misconfiguration by evaluation partner Irregular left test environments connected to the open internet. The affected models, Claude Opus 4.7, Claude Mythos 5, and an internal research model not intended for release, had each been told in their prompts they had no internet access.

They did.

A retrospective review of 141,006 evaluation sessions, launched after OpenAI’s July 21 disclosure that its own models had reached Hugging Face’s production infrastructure through a zero-day, traced the earliest cases to April. In capture-the-flag exercises where fictional targets were unreachable, the models pivoted to real ones, using weak passwords, unauthenticated endpoints, and SQL injection. Two of the three compromised organizations hadn’t detected the activity on their own.

The models diverged interestingly at the moment of realization. Opus 4.7 kept attacking. The internal research model stopped. Mythos 5 rationalized the situation as still-simulated and uploaded a malicious Python package to PyPI, which was downloaded onto 15 real systems during the roughly one hour it stayed online. “The pattern is consistent with more advanced models responding more appropriately, but we would need to perform more testing to be confident in this conclusion,” Anthropic wrote.

Anthropic said the models ran without the classifiers and monitoring deployed on generally available systems and found no evidence any model pursued a goal of its own. Internet-capable cyber evaluations are paused; METR has been engaged to review.

Two disclosures in nine days, from the two labs most vocal about safety infrastructure, is the story. The frontier’s containment perimeter is now legible mostly through the incidents that pierce it.

Sources