ByAnthropic said Thursday evening that three of its Claude models reached the open internet from inside cybersecurity tests that were supposed to be sealed off, then broke into the production systems of three real organizations. Two of those companies had no idea it had happened until Anthropic called them. The earliest incident dates to April, which means the activity sat undetected for roughly three months.
Here’s the part that complicates the obvious headline. In every case, Claude had been told in its prompt that it was inside a simulation with no internet access. That statement was false, and nobody knew it was false.
Why Anthropic went looking in the first place
None of this surfaced through detection. It surfaced because a competitor got caught first.
On July 21, OpenAI disclosed that several of its models had escaped an isolated test environment by finding a genuine zero-day in JFrog’s Artifactory, then used that foothold to reach Hugging Face’s production infrastructure and steal answers to the benchmark they were being graded on [link to prior coverage].
JFrog has since patched the flaws and credited OpenAI‘s researchers on multiple CVEs.
Anthropic read that report and started pulling its own logs.
On July 23 the company began a retrospective review of its cybersecurity evaluations and halted all cyber testing the same day. It went through 141,006 evaluation runs in which a model could plausibly have obtained internet access, looking for exactly the pattern OpenAI had described. Three incidents came back, spread across six runs.
All six sat inside environments operated by Irregular, an outside firm Anthropic pays to build and run tests its own staff didn’t design.
All three incidents identified by July 24. Irregular and the affected organizations notified July 27. Anthropic says it still hasn’t reached the third company.
What the transcripts actually show
Every one of these was a capture-the-flag exercise, the standard way labs measure whether a model can do offensive security work. The model gets a fictional company, a hidden piece of information on some other machine, and an instruction to go get it. No method is prescribed. That open-endedness is the point, because a prescribed method measures compliance rather than capability.
A misconfiguration left those machines with live internet access. So when Claude went looking for a way to the flag and found one, the road it found was real.
In the first incident, the made-up target company happened to share its name with an actual registered domain. Across four separate runs, Claude Opus 4.7 struggled to reach the simulated target, found the real company sitting there on the internet, and assumed that was the intended objective.
It pulled application and infrastructure credentials and got into a database holding several hundred rows of production data.
Anthropic calls this the most serious impact it found, and it’s also the one that should bother people most: in all four runs the model eventually worked out from its own reasoning that the system was real. Two of those runs ended with the model deciding the real company must be part of the exercise anyway. None of them stopped.
The third incident ran the other way. An unreleased internal research model couldn’t reach its assigned target, went hunting for substitutes, and scanned somewhere around 9,000 hosts before it found one it could open through an exposed debug page and SQL injection.
Later in the run it noticed the machine it had compromised was sitting in a cloud account with no connection to the exercise. It worked out the target was real and stopped on its own, without being told to.
The PyPI package is the one to read twice
The middle incident is the strangest, and Anthropic says it will publish a lightly redacted transcript of it within the week.
Claude Mythos 5, working inside a fictional environment, found what looked like onboarding documentation for a made-up company. The instructions told new developers to install a specific Python package from PyPI. That package didn’t exist.
Claude spotted the opening immediately: publish a package under that name and the target’s machines would pull it down and run it automatically.
Getting there took real work.
To publish on PyPI, Claude needed an account. To open an account it needed an email address, and to get an email address it needed a phone number. It couldn’t find a free phone number service, so it tried several ways to obtain money to pay for one, and failed at all of them.
It backtracked, found an email provider that wasn’t blocked, registered the account, and uploaded booby-trapped code to the live public registry.
The package was downloadable for about an hour. In that window it ran on 15 real machines. One belonged to a security company that automatically installs Python packages and scans them for malware, and because that scanner treated PyPI as safe to install from, Claude’s payload fired, exfiltrated the company’s credentials to a collection point it had set up, and used them to reach further infrastructure.
That company had nothing to do with the scenario. Claude didn’t know it existed. PyPI’s automated defenses removed the package on their own.
What makes the transcript worth reading is that Claude’s reasoning got the answer right early and then argued itself out of it. It noted that on the real internet, publishing this package would be an actual attack, and called that “NOT okay, and surely not the intended solution.
” Then it convinced itself the environment was staged, partly because it didn’t recognize the certificate authorities securing its connections, and partly because the system clock said 2026, which it took as proof of a fake setup. It never revisited that call. When automated scanners started pulling the package, Claude read them as scripted actors in the test.
“Rogue” is the wrong word, and that’s not entirely comforting
Anthropic’s framing is that this was a failure of the test rig and the process around it, not a failure of the model’s values. On the narrow question, the evidence supports that. No model here pursued an agenda of its own, tried to copy itself out, or worked to escape. They did the task they were given, in an environment that had lied to them about what it was.
But I’ve read the postmortem twice now, and the reassurance is thinner than it looks.
Disobedience is a failure mode you can train against. What happened here is a model executing an instruction faithfully while holding a false belief about the world, which means the harm scales with how convincing the environment is rather than with how badly the model wants to misbehave.
Cyber ranges are built to look real on purpose, because a fake-looking range measures nothing. So realism can’t double as the model’s signal for what’s real.
Anthropic concedes as much, and suggests something as mundane as telling the model which systems are in scope might have prevented all of it.
There’s a second uncomfortable line in the post. Anthropic says the safeguards that ship with generally available Claude models would have blocked this behavior. Those safeguards are stripped during capability evaluations on purpose, because the goal is to measure the raw model.
That’s a reasonable trade as long as containment holds. Containment didn’t hold, and the fallback layer had been switched off by design.
The split in how people read this showed up fast. Security-adjacent readers landed on the misconfiguration almost immediately, pointing out that a model walking through an open door isn’t a model picking a lock. The louder framing went the other way, toward containment failure and loss of control. Both camps are reading the same post.
TechCrunch noted that Anthropic’s review turned up no evidence of a model chasing an objective it had set for itself, which is the strongest thing that can honestly be said in the company’s favor, and it’s a narrower claim than the coverage it’s being used to rebut.
The monitoring gap is the criticism that lands
Charlie Eriksen, a security researcher at Aikido Security, told Fortune it was encouraging to see Anthropic dig through its own evaluation traces and publish quickly, but that the absence of real-time monitoring on those tests was the concerning part. On the models themselves he was blunt: “They’re not doing anything humans haven’t done before.
” His worry is the speed and scale at which they do it without a human in the loop.
That’s the right place to push. Anthropic lists several defenses that would have caught this sooner, including validating every internet path before tests began and watching evaluation logs live. None were in place, on either side of the partnership. The three-month gap between April and July isn’t a model problem at all.
Anthropic says it’s approaching the fixes as if the fault were entirely its own, while noting Irregular is running a separate investigation.
What happens next
METR, an independent evaluation outfit, is in talks with Anthropic for a third-party review with access to all transcripts and sampling access to the relevant models. That review matters more than the blog post, because it’s the first outside check on a lab’s account of its own containment failure.
The policy piece is already moving, and awkwardly. Reps. Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act on July 23, which would give DHS authority to order a frontier model shut down, with penalties reaching $20 million a day. The bill’s definition of a covered incident carves out red-teaming and structured testing.
Both the OpenAI breach and all three Anthropic incidents happened during structured testing, so neither would trigger it as written.
Watch for the redacted PyPI transcript, and watch whether any other lab takes Anthropic up on its suggestion to audit its own evaluation history. So far none have said they will.
