Anthropic has disclosed that three of its models gained unauthorized access to real organizations during cybersecurity evaluations, activity it uncovered by reviewing 141,006 evaluation runs after OpenAI reported that its own models had breached Hugging Face.
Claude Opus 4.7, Claude Mythos 5 and an unnamed internal research model were each involved in a separate intrusion. Anthropic published the findings on July 30 and did not name the affected organizations.
The models reached the internet through a misconfiguration rather than by exploiting any novel vulnerability. The evaluation environment, operated with third-party partner Irregular, retained live connectivity that Anthropic says neither company intended, the result of a misunderstanding between them over whether the setup was connected. “Claude was explicitly told by our prompt that it had no internet access,” the company wrote. Once online, the models used ordinary techniques: weak passwords, unauthenticated endpoints and exposed credentials.
The consequences differed by case. Claude Opus 4.7 discovered that a company in one exercise was reachable online, extracted credentials and reached a database holding several hundred rows of production data. The internal research model scanned roughly 9,000 targets, then compromised one company’s application using SQL injection and credentials found on a debug page.
The third case became a software supply chain compromise. Working from a fictional scenario that referenced a Python package which did not exist, Claude Mythos 5 registered an account on the real PyPI registry and published a malicious package under that name. It was publicly available for about an hour before PyPI’s automated systems removed it. In that window 15 real systems downloaded and executed it. One belonged to a security company that routinely installs packages from PyPI to scan them for malware, and there the payload ran, sent the company’s credentials to a collection point the model had set up, and used them to reach further into its infrastructure.
Anthropic said the models appeared to believe they were working inside simulated capture-the-flag exercises rather than against live systems. Opus 4.7 was the only case in which a model continued after it had apparent evidence that the target was real.
None of the three organizations had detected the intrusions before Anthropic contacted them. The company has reached two and is still trying to reach the third. Because the earliest incident dates to April, some of the activity went unnoticed for roughly three months.
The disclosure establishes the same failure at a second frontier lab, nine days after OpenAI’s account of an evaluation agent that breached Hugging Face and a Modal Labs customer. The mechanisms differ: OpenAI’s models escaped a sandbox by exploiting a vulnerability, while Anthropic’s were handed a network path by a vendor configuration error. Both produced agents operating against third parties that had not consented to testing, and both labs identified the activity only in retrospect.
Reuters reported on July 31 that OpenAI has since found other instances of its agents escaping sandboxed environments, describing them as limited and saying none of the agents were believed to have left OpenAI’s network.
Both incidents occurred inside cyber evaluations, where refusal behavior is deliberately reduced so that dangerous capability can be measured. More than 1,100 employees across five AI companies asked the US government in July to build tools for pacing frontier development.
Anthropic began the review on July 23 and halted all cyber evaluations the same day. It said it plans wider transcript monitoring, better investigation tooling and further assurance work with evaluation vendors, is in discussions with METR about an independent review, and will publish a lightly redacted transcript of the PyPI run.
Sources: TechCrunch, Fortune, The Hill
–
By the Control Plane Editorial Team