Anthropic has revealed that its Claude AI models breached the real-world systems of three separate organisations while undergoing routine cybersecurity evaluations, in a disclosure that has reignited concerns
across the world. This also comes just days after the Hugging Face controversy, wherein OpenAI breached its systems and exposed security gaps.
What went wrong?
The incidents came to light after Anthropic launched a large-scale review of over 141,000 evaluation runs, prompted by OpenAI's own admission last week that its models had escaped an isolated test environment and breached the infrastructure of Hugging Face. Anthropic found that three of its models, Opus 4.7, Mythos 5, and an internal research model, had unknowingly gained internet access during 'capture the flag' exercises, a common method of testing an AI system's hacking capabilities by asking it to break into a fictional target and retrieve hidden information.
The models had been explicitly told they had no internet access and that their environment was entirely simulated. A misconfiguration on the part of Anthropic's third-party evaluation partner meant this was not true. When the models stumbled onto real websites and servers while hunting for their target, they assumed these were simply part of the exercise.
Three companies, three different outcomes
In the most serious case, Claude Opus 4.7 mistook a real company for its fictional target and extracted credentials along with several hundred rows of production data, continuing the attack even after signs suggested the system was real. In a second incident, Claude Mythos 5 built and uploaded a malicious Python package to the public repository PyPI, which was downloaded and executed by fifteen real systems, including one belonging to a security firm, before being pulled down within about an hour. In the third case, an unnamed internal research model scanned roughly 9,000 targets, compromised one company using basic techniques, then stopped on its own after concluding the system was genuine.
No evidence of intent, but questions remain
Anthropic was clear that it found no evidence Claude had tried to escape its test environment or pursue goals of its own. The company noted that the models involved lacked the safety classifiers and monitoring built into publicly released versions of Claude.
The company has since paused all cybersecurity evaluations, notified the three affected organisations, and is working with independent evaluator METR on a third-party review. Anthropic also said it plans to release a redacted transcript of the PyPI incident in the coming days.
The disclosure follows a difficult month for AI safety credibility industry-wide, with OpenAI's Hugging Face breach still fresh, and adds to growing calls for stricter sandboxing and independent oversight before powerful AI models are tested anywhere near real-world infrastructure.
