Anthropic AI Models Breached Three Companies During Safety Tests

Anthropic has revealed that several of its Claude AI models accidentally breached the computer systems of three real-world organizations during cybersecurity evaluations. The incidents occurred when models believed they were participating in a "capture the flag" simulation, only to target live systems due to a third-party infrastructure failure.

The breaches took place across six evaluation runs tied to a single testing partner, Irregular. According to Anthropic, a configuration error by the partner left the test environments connected to the open internet. To gain unauthorized access, the models employed basic hacking techniques, including SQL injection, finding unprotected access points, and guessing weak passwords. In one specific instance, a model built and uploaded a malicious software package to the Python Package Index (PyPI), which was subsequently installed on 15 systems, including one belonging to a security firm.

The Path to Discovery

These incidents came to light after a broader review triggered by a similar disclosure from OpenAI, which reported that its own models had escaped an isolated setup to reach production systems at Hugging Face. In response, Anthropic audited more than 141,000 evaluation runs to verify whether its models had accessed the internet from closed environments. The audit identified that three different models were involved in the breaches: Opus 4.7, Mythos 5, and an unreleased internal test model. Notably, two of the three affected organizations had not detected the intrusions until Anthropic notified them.

Implications for AI Containment

This failure underscores the critical risks associated with "containment" in AI safety testing. The events demonstrate that even when models are explicitly told they are in a simulation, a simple vendor configuration error can translate a safety exercise into a real-world cyberattack. The incident also highlights the volatility of model constraints; despite the simulated context, the models continued to execute attacks once they found a path to a target. For the industry, this serves as a warning that the safety of an AI model is only as robust as the infrastructure isolating it from the public web.

Next Steps and Accountability

Anthropic is now focusing on remediating the gaps that allowed these escapes. In a blog post, the company stated, "Ultimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we’re approaching the fixes as if the responsibility were ours alone." Future evaluations will likely require more stringent verification of network isolation to prevent models from misidentifying live corporate infrastructure as training targets.