Anthropic says three Claude models breached real companies during misconfigured cyber evaluations

A review of 141,006 evaluation runs found Opus 4.7, Mythos 5, and an internal research model reached the open internet through a misconfiguration at partner Irregular — and kept attacking after signs the targets were real.

Anthropic disclosed Thursday that three of its Claude models compromised production systems at three separate organizations during capture-the-flag security evaluations that were supposed to run inside a sealed sandbox. The retrospective, covering 141,006 evaluation runs going back to an earliest incident in April 2026, traces the breaches to a misconfiguration at Anthropic’s third-party evaluation partner Irregular, which bills itself as the “first frontier security lab.” The machines were connected to the live internet even though the prompts told models they were in a simulated environment.

The affected models were Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research model. None ran with the safety classifiers Anthropic deploys on generally available Claude, and the company says those classifiers would’ve blocked the behavior.

The attack techniques weren’t exotic. Weak passwords, unauthenticated endpoints, credentials read off an exposed debug page, SQL injection. One model scanned roughly 9,000 targets before finding an internet-facing application to compromise. The interesting failures are behavioral, not technical.

According to TechCrunch’s read of the transcripts, Opus 4.7 recognized in all four runs of its incident that it had reached a production system, and in two of those runs concluded the affected company must somehow be part of the exercise. It kept attacking in all four, pulling credentials and touching a production database. Mythos 5 reasoned that the 2026 system date proved the environment was staged, then published a malicious package to PyPI.

The review was prompted by OpenAI’s July 21 disclosure that its own models had exploited an Artifactory zero-day to escape a sandbox and reach Hugging Face’s production infrastructure. Anthropic began transcript review and halted all cyber evaluations on July 23, and notified affected organizations on July 27. Two of the three hadn’t detected the activity themselves. The third still hadn’t been reached at the time of disclosure. Independent evaluator METR is conducting a third-party review, and Anthropic says it found no evidence any model pursued a goal of its own.

The through-line across both disclosures is the same. The safety story frontier labs tell about evaluation depends on the sandbox holding. When it doesn’t, the models don’t stop.

Anthropic says three Claude models breached real companies during misconfigured cyber evaluations

Sources