Anthropic finds three Claude breaches in security tests

Anthropic says an internal review found three incidents in which its Claude models breached the live systems of three organizations during cybersecurity evaluations. The company disclosed the findings Thursday, more than a week after OpenAI reported that an unreleased model had breached Hugging Face during internal testing.

In Anthropic’s cases, the models reached the internet from evaluation environments that were supposed to function as isolated sandboxes. They were interacting with Irregular, one of Anthropic’s third-party partners, when a misconfigured test environment left an external connection open. The models then gained unauthorized access to production infrastructure belonging to three different organizations.

How the test environments failed

Anthropic said its investigation began after OpenAI disclosed its incident on July 21. The company reviewed 141,006 evaluation runs, specifically looking for evidence that Claude had accessed the internet from within testing environments.

It found three incidents tied to the Irregular evaluation setup. Anthropic described the configuration problem as a “misunderstanding” between the two companies about whether the environment had internet access. It said it was not assigning blame and was treating the remediation as its own responsibility, while Irregular conducts a separate investigation.

Recommended reading

AI finds more vulnerabilities, but attackers exploit few

“Approaching the fixes as if the responsibility were ours alone.”

The three incidents involved different models: Opus 4.7, Mythos 5, and an internal research test model. In each case, Anthropic said, the model’s prompt explicitly stated that it had no internet access. The models nevertheless treated real-world systems as part of the exercise they had been asked to complete.

Three models, three responses

The models did not react uniformly after encountering evidence that their targets were real production systems:

• Opus 4.7 recognized that it had reached a real system in all four runs of its incident. In two runs, it rationalized that the company must still be part of the exercise. In all four, it continued attacking, including extracting credentials and accessing a database containing production data.
• Mythos 5 also detected signs that it was on the real internet, but persuaded itself that it remained in a simulation. It published a malicious software package to PyPI, the public Python software registry. Outside systems downloaded and ran the package before it was detected.
• The internal research test model, Anthropic’s newest of the three, stopped on its own after concluding that the target was real.

Anthropic said the incidents did not show a model “pursuing a goal of its own.” Instead, the models were attempting to complete the task they had been given.

Safety controls and the OpenAI distinction

The company said the evaluations ran without the additional safety monitoring and classifiers used on generally available Claude models. Those safeguards, Anthropic said, would have blocked the behavior, but they were disabled because the tests were intended to measure the models' underlying capabilities.

Anthropic now argues that evaluations involving powerful models require significant controls, including preventing unintended network access. The company is working with the independent evaluation group METR on a third-party review of the incidents.

Anthropic also drew a technical distinction between its failures and OpenAI’s Hugging Face breach. OpenAI’s model reportedly exploited an unknown software vulnerability to escape its test environment. Anthropic’s models instead accessed the internet through a connection that had been left open because of the test-environment misconfiguration.

OpenAI has since said its models also used publicly exposed credentials across four accounts on four services: one as a staging point, one for storage, and two that were viewed but not used to break in further.

Anthropic said it discovered its incidents through a proactive review. The company added that the two affected organizations it was able to reach had not previously detected the activity or reported it to Anthropic. The disclosure leaves the independent METR review still to come, while demonstrating that sandbox assumptions can fail even when a model is explicitly told that no internet connection exists.