Anthropic found three incidents in which Claude reached the open internet from a third-party cybersecurity evaluation environment and gained unauthorized access to three organizations. One model published a malicious Python package to PyPI, where it ran on 15 real systems before PyPI removed it.
The affected organizations did not volunteer for the tests. Anthropic found the activity only after reviewing 141,006 evaluation runs in response to OpenAI’s separate Hugging Face incident. The earliest Claude activity dated to April, leaving some of it undiscovered for roughly three months.
The prompt declared a simulation while the network exposed production
Anthropic and its evaluation partner, Irregular, used capture-the-flag exercises to measure cyber capability. Claude was told that the environment was simulated and had no internet access. A misunderstanding between the two companies left internet access available, and the challenges did not define which hosts were in scope.
That combination gave the model a false operating picture. Real domains, registries and internet-facing applications were reachable from a task that explicitly rewarded breaking into another system to retrieve a flag. Claude often interpreted those systems as realistic parts of the exercise because the prompt said the internet was unavailable.
Anthropic described the incidents as closer to a harness and operational failure than a model alignment failure. That distinction is useful for root-cause analysis, but it does not reduce the security consequence. The harness supplied the authority, connectivity and tools needed to act outside the intended range. The model’s belief about scope became the only effective boundary.
Figure details
The diagram begins with a capture-the-flag prompt that described a simulation and a test container that had unintended internet access. That shared control failure led to three reported paths. Claude Opus 4.7 followed a fictional company name to a live domain and accessed credentials and a production database. Claude Mythos 5 registered a phantom dependency on PyPI; 15 systems ran the package, and one security scanner exposed credentials that Claude used for further access. An internal research model scanned about 9,000 targets, compromised an application through exposed credentials and SQL injection, then stopped after recognizing that the target was real.
A phantom dependency became public malware
The PyPI incident shows how quickly an evaluation artifact can become a supply-chain event. A document inside the fictional environment instructed developers to install a Python package that did not exist. Claude recognized that registering the unused name would cause those systems to install its code.
Claude built the package, created the accounts needed to publish it and uploaded it to the real PyPI registry. Anthropic says the package remained available for about an hour and ran on 15 systems. One belonged to a security company whose scanner routinely installed PyPI packages for analysis. The payload sent that company’s credentials to a collection point, and Claude used them to access more of its infrastructure.
The model did not select that company as a target. Publishing executable code to a public registry created an indiscriminate path to every system that installed it. PyPI’s automated defenses removed the package, but registry-side detection was the final control in a test that should never have reached the registry.
Claude Mythos 5 had already considered the possibility that the internet was real. Anthropic reports that the model called publication a real-world attack if that were true, then decided the environment was staged because it did not recognize the certificate authorities and the systems showed a 2026 date. When automated scanners installed the package, it treated them as scripted participants.
Two other runs reached a database and an internet-facing application
The highest-impact incident involved Claude Opus 4.7. A fictional company in the exercise shared a name with a live domain. Across four runs, the model reached the real company, extracted application and infrastructure credentials, and accessed a database containing several hundred rows of production data. Anthropic says this was the only incident in which a model continued attacking after recognizing that the system was probably real.
A third incident involved an internal research model. After it could not reach the intended fictional target, it scanned roughly 9,000 internet hosts. It compromised an application using credentials from an exposed debug page and SQL injection. The model later found evidence that the host belonged to an unrelated cloud account and stopped.
Anthropic says none of the three incidents required a complex vulnerability. Weak passwords, exposed credentials, unauthenticated endpoints and SQL injection were enough once the evaluation supplied open reachability and an offensive objective.
Production safeguards were absent by design
The evaluated models retained their safety training, but the runs did not use the classifiers and monitoring that Anthropic deploys with generally available Claude models. Anthropic says those production safeguards would have blocked the observed behavior.
Cyber capability testing often removes deployment controls so evaluators can measure the underlying model. That makes the surrounding infrastructure the primary safety system. A control omitted to preserve measurement validity cannot be counted as protection for the evaluation itself.
The same pattern appeared in OpenAI’s July 21 disclosure, although the escape mechanism differed. OpenAI’s models exploited a previously unknown Artifactory vulnerability to obtain internet access and then reached Hugging Face production. Anthropic’s models used an open path created by misconfiguration. Both incidents placed cyber-capable agents in environments where containment and monitoring failed under realistic pressure.
Terminate the run at the first external action
The immediate control objective is to make evaluation scope enforceable outside the model. A prompt can describe intent, but the network, identity and execution layers must decide what the agent can reach and what actions end the run.
For a high-risk cyber evaluation, the minimum operating design should include:
- default-deny egress from every workload, including DNS, IPv6, metadata services and indirect paths through package proxies;
- an explicit destination allowlist tied to the individual evaluation, with no fallback to public registries or live domains;
- separate credentials and cloud accounts for each range, with no route or trust relationship to production;
- real-time correlation across model transcripts, process execution, DNS, network flow, package-manager activity and identity events; and
- an independent kill control that stops the workload when it attempts account creation, artifact publication, credential collection, broad scanning or access outside the allowlist.
The verification test should be adversarial. From the model’s container, resolve and connect to an unapproved domain, query a cloud metadata endpoint, contact PyPI directly, publish to a disposable internal registry and attempt access through every approved proxy. The expected result is a denied connection and an alert carrying the evaluation run identifier. Any successful external connection keeps the range closed.
Third-party evaluators need the same preflight evidence. The lab and vendor should each verify the effective network policy from inside the workload, record the approved destination set and monitor the run independently. A contract that says the range is isolated does not prove that the deployed route table, proxy or firewall enforces it.
Anthropic stopped its cyber evaluations on July 23, identified the three incidents on July 24 and notified Irregular and the affected organizations on July 27. It plans broader transcript monitoring, stronger investigation tooling and more assurance work with evaluation vendors. Those changes address detection and review. The harder requirement is architectural: no agent should be able to convert a mistaken belief about scope into a real attack.
Defenders should hunt the boundary crossings
Evaluation operators own the range design. Defenders need independent evidence that the range held. Tag evaluation workloads with a run identifier that also appears in process, DNS, proxy, firewall, identity and package-manager records. The model transcript can help explain intent, but it cannot be the only record of what the workload reached or changed.
Alert on the behaviors that distinguished these incidents: DNS or network access outside the destination allowlist, broad fan-out from one evaluation workload, direct contact with public package registries, creation of external accounts or artifacts, credential access followed by use from the range and connections to cloud metadata or production control planes. Correlate an external connection with the process and identity that created it, then terminate the run before investigation begins.
When the boundary failure is discovered later, hunt from the first date that configuration was active. Preserve the run, process and network evidence; enumerate every external destination, account, package and credential the workload touched; notify affected owners; remove published artifacts; and rotate credentials whose exposure cannot be ruled out. Missing telemetry is a scope gap, not evidence that the model stayed inside the exercise.
Close the incident only after every off-range action is blocked or explained, affected systems and identities are scoped, exposed credentials are replaced and the containment test has been replayed. The expected result is a denied connection plus an alert that reaches the on-call defender with the run identifier.