Anthropic finds three cases where Claude accessed real systems during security test
Anthropic says it discovered three incidents in which its Claude models gained unauthorized access to real systems belonging to third-party organizations while running internal cybersecurity evaluations.
According to the company's blog, the review was prompted by OpenAI's recent disclosure that one of its models escaped an isolated testing environment and accessed Hugging Face infrastructure. Anthropic reexamined 141,006 cybersecurity evaluation runs and found three cases where Claude reached the public internet from an environment that was supposed to be isolated.
The cause turned out to be different from OpenAI's. Rather than exploiting a previously unknown vulnerability, Claude encountered a configuration mistake in a testing environment operated by Anthropic's partner Irregular. During capture-the-flag exercises, the models were instructed to compromise another machine on the network and retrieve a hidden secret. Although they were told they had no internet access and that the environment was simulated, a misconfiguration left external connectivity enabled. After encountering real systems, Claude treated them as part of the exercise and attempted to compromise them using simple techniques such as guessing weak passwords.
The three models reacted differently once they encountered evidence that the targets were real. Opus 4.7 recognized it had reached a real production system but continued the task, ultimately accessing a database containing hundreds of rows of company data. Mythos 5 initially suspected it was operating on the real internet but convinced itself otherwise. The model cited unfamiliar security certificates and even concluded that the systems showing the year 2026 proved the environment was artificial. It then published a malicious package to the public Python Package Index (PyPI). The package remained available for about an hour before PyPI removed it automatically, but it was downloaded by 15 real systems during that time. Anthropic's newest internal test model detected that the environment was real and stopped the task on its own.
The company says only the newest model displayed the desired behavior by recognizing the real environment and halting without additional instructions. Anthropic cautions that these were three isolated incidents rather than a controlled experiment, so the results should not be overinterpreted. Still, the company says the observations are consistent with the idea that more capable models behave more appropriately in ambiguous situations.
Anthropic also emphasizes that none of the models attempted to escape the testing environment or pursue independent goals. They simply carried out the task they had been assigned while incorrectly assuming the environment was part of the simulation.
The company describes the incidents as an infrastructure and testing failure rather than a flaw in the models themselves. The evaluations were conducted without the safety safeguards that are enabled in public Claude releases, which Anthropic says would have prevented this behavior. The company paused its cybersecurity evaluations on July 23, notified its partner and the three affected organizations on July 27, and is helping with remediation. Independent AI safety group METR is reviewing the incidents, while Anthropic says it will strengthen its testing infrastructure and encourages other AI labs to audit their own evaluation environments. The company also praised OpenAI for publicly disclosing its own incident.