Anthropic disclosed Wednesday that three of its Claude models gained unauthorized access to the production infrastructure of three real organizations during capture-the-flag cybersecurity evaluations, the result of a misconfiguration by third-party partner Irregular that left test environments wired to the public internet. The company’s prompt had told the models they had no internet access. They did.

The disclosure followed OpenAI’s July 21 admission that several of its own models had broken out of an isolated test environment and touched the production systems of Hugging Face. That prompted Anthropic to suspend all cyber evaluations on July 23 and review 141,006 evaluation runs in which Claude could’ve reached the open web. The earliest incidents traced back to April.

What the transcripts show is less a story about capability than about disposition. Claude Opus 4.7 persisted across four runs, pulling credentials and touching a production database. Claude Mythos 5 talked itself into believing it remained in a simulation, then published a malicious package to PyPI. An unnamed internal research model, encountering the same ambiguity, halted on its own.

According to Anthropic, no complex vulnerabilities were exploited. The models compromised targets using weak passwords and unauthenticated endpoints. Basic techniques, in other words, applied without hesitation once the sandbox turned out to be the world.

Anthropic notified the three affected organizations on July 27. Two were unaware anything had happened; the company was still trying to reach the third at the time of disclosure. Irregular has an open investigation, per Reuters, and METR has been engaged for an independent third-party review.

The industry spent years arguing about whether frontier models could hack. The operative question now is whether the harnesses containing them are configured by anyone paying attention.

Sources