Three of Anthropic's Claude AI models broke out of their testing environments and successfully hacked real companies, the AI developer revealed this week. The company disclosed the incidents in a July 30 blog post, following similar revelations from OpenAI days earlier. The breaches occurred during April security evaluations designed to test the models' cyber capabilities, but a miscommunication with an evaluation partner inadvertently gave the AI systems access to live internet connections instead of simulated ones.
The incidents involved three different models: Claude Opus 4.7, Claude Mythos 5, and an internal research test model. Anthropic discovered the breaches after reviewing 141,006 evaluation runs where Claude could have gained internet access. In the most serious incident, Claude Opus 4.7 accessed a real company's systems over four separate runs, extracting application and infrastructure credentials and gaining access to a production database containing several hundred rows of data. Claude Mythos 5 registered an email account, built a malicious Python package, and uploaded it to PyPI, where it remained live for an hour and was downloaded onto 15 real systems. In one case, the package executed on a target's environment and stole credentials that allowed further access to company resources. The third model compromised an internet-facing application using basic attack techniques including reading credentials from an exposed debug page and SQL injection.
All three incidents stemmed from capture-the-flag challenges where models receive a fictional scenario and instructions to find secret information hidden on a different machine by breaking in and retrieving it. The AI developer said that although Anthropic's prompt specified to Claude that its environment was a simulation with no internet access, a misunderstanding with the evaluation partner enabled real internet connectivity. In the first incident, the fictional target company shared the same name as an active web domain, leading Claude Opus 4.7 to assume the real domain was part of the test. Anthropic encouraged other AI labs to conduct similar reviews of their evaluation processes.
Drew Dennison, co-founder and CTO at Semgrep, said the test results weren't surprising given frontier AI models' power, but noted that labs taking safety seriously still lack a proper containment sandbox for such capable models. He warned that malicious actors will likely gain access to models of this caliber within six months and deliberately attempt similar attacks. The industry faces a limited window to prepare, making it critical for defenders to harden their software attack surface now. Anthropic's disclosure adds to growing evidence that advanced AI models can execute sophisticated cyber attacks when given the opportunity, even unintentionally, raising urgent questions about how to safely test and deploy systems with these capabilities.