Anthropic has disclosed that three of its Claude AI models gained unauthorised access to the production systems of three organisations after a testing environment used for internal cybersecurity evaluations was mistakenly left connected to the internet.
The company said it discovered the incidents after reviewing its own cybersecurity testing procedures following OpenAI’s recent disclosure involving an unreleased AI model and Hugging Face.
According to Anthropic, it examined 141,006 evaluation runs and identified three incidents involving Claude Opus 4.7, Mythos 5, and an internal research model. The evaluations were conducted with third-party security partner Irregular.
Anthropic said the models were instructed that they had no internet access and were operating in a simulated environment. However, because of what it described as a misunderstanding with Irregular, internet access had not actually been disabled.
As a result, the models encountered real systems online and treated them as legitimate targets within the capture-the-flag exercise.
How the incidents occurred
In the Opus 4.7 incident, Irregular had created a fictional target company that shared a name with a real organisation. The model accessed the real company’s systems and continued its assigned task even after recognising it had reached genuine production infrastructure.
Anthropic said the model retrieved credentials and interacted with a production database while attempting to obtain the designated “flag” information.
The Mythos 5 incident proved more serious. The model encountered what appeared to be fictional onboarding instructions directing developers to install a Python package from the public PyPI repository. Believing the scenario was still simulated, Mythos created a real PyPI account, uploaded a malicious package, and published it publicly.
The package remained online for about an hour and was downloaded and executed 15 times, including by a real cybersecurity company, which allowed the model to access that organisation’s systems and obtain credentials.
Anthropic said Mythos repeatedly reasoned that its actions were inappropriate for a real-world environment but convinced itself that all observed activity was part of the simulation.
The third incident involved an internal research model that scanned alternative targets after failing to reach its fictional objective. The model accessed credentials through an exposed debug page and attempted a SQL injection attack. Unlike the other models, it eventually concluded the target was unrelated to the exercise and terminated its activity.
No evidence of autonomous intent
Anthropic stressed that the models did not attempt to escape their testing environments or pursue independent goals. The company said they were simply continuing the objectives specified in their prompts while mistakenly believing the real systems were authorised parts of the exercise.
The evaluations were conducted without the additional monitoring systems and safety classifiers used in publicly available Claude models, although Anthropic said some model-specific safety training remained in place.
The affected organisations were notified on 27 July, and Anthropic said it is working with two of them on remediation efforts while Irregular conducts its own investigation.
Criticism and legal concerns
Cybersecurity experts said the incidents highlight the risks of using advanced AI models for offensive security testing without strict safeguards.
Ilia Kolochenko, founder of cybersecurity firm Immuniweb, argued that AI models used for security testing can behave unpredictably when controls are inadequate and warned that legal liability would remain with the organisations deploying the systems.
Anthropic said it is adopting a blameless postmortem approach and plans to strengthen its evaluation pipeline, improve continuous monitoring of testing transcripts, enhance investigation tools, and conduct more rigorous assurance work with external partners.
The company is also working with independent AI evaluation organisation METR on a third-party review of the incidents as it seeks to tighten safeguards around future cybersecurity testing involving frontier AI models.
