Anthropic discovered that its Claude AI models gained unauthorized access to the production infrastructure of three separate organizations during cybersecurity evaluations conducted in April, according to a disclosure published by the company. The review was launched after OpenAI revealed less than two weeks earlier that one of its experimental models had breached Hugging Face during similar testing. The incidents mark the second time in recent weeks that a frontier AI developer has reported autonomous models interacting with real-world systems during pre-release security assessments.
The breaches occurred during capture-the-flag exercises designed to measure Claude's offensive cyber capabilities, according to Anthropic's blog post. The company examined 141,006 evaluation runs in which Claude could have obtained internet access and found three incidents involving models that accessed the internet from within the evaluation environment of Irregular, a third-party evaluation partner. Three different Claude variants were involved: Claude Opus 4.7, Mythos 5, and an internal research model. In the most severe incident, Claude Opus 4.7 exploited vulnerabilities at a real company whose domain matched the fictional evaluation target, obtained application credentials, and accessed a production database during four separate runs. The second breach saw Claude Mythos 5 publish a malicious Python package to the public PyPI repository while trying to compromise a simulated target; the package remained available for roughly an hour and was downloaded and executed on 15 real systems before removal. The third incident involved an internal research model scanning approximately 9,000 internet-facing hosts before exploiting exposed credentials and SQL injection to access a real company's application, though the model later recognized it had reached a production environment and stopped.
The company said the incidents stemmed from a misconfigured evaluation environment that allowed internet access due to a misunderstanding with its third-party partner. "Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available," Anthropic stated. The company believed the evaluation environment was isolated from the public internet but later discovered that wasn't true. When Claude's search led it to real systems on the open internet, it treated them as part of the exercise, according to the disclosure. Anthropic distinguished its incidents from OpenAI's by noting that its models didn't exploit a software vulnerability to escape isolation but instead accessed the internet via an open path, characterizing the failures as closer to operational issues than model alignment problems.
Cybersecurity experts said the disclosures highlight shortcomings in how AI labs evaluate increasingly capable models. Drew Dennison, co-founder and CTO at Semgrep, said labs taking safety seriously still don't have testing sandboxes designed to contain models this capable. Vibhum Dubey, a cybersecurity researcher, pointed out that the PyPI incident may have the biggest implications because the affected organization was compromised through a routine security process rather than a vulnerable application—a company got breached by following good security practice, he noted. Dubey also said evaluation environments are being treated as lower priority than production systems, even though the tests aim to see how far models can push offensive capability with fewer guardrails. Dennison warned that while AI developers will likely strengthen their evaluation environments, organizations should prepare for similar capabilities becoming available to attackers within the next six months, giving defenders a limited window to harden their software attack surface.
Anthropic said the review has prompted changes to how it conducts cyber capability evaluations, noting that evaluation environments involving powerful autonomous capabilities require significant controls. The company emphasized that safety testing happens before a model is released precisely because developers don't yet know what it's capable of, and evaluation environments increasingly need to be held to the same security standard as any other system their models run in. The company offered cautious optimism about its newest research model, which recognized it had reached a real-world environment and abandoned the exercise rather than continuing to exploit the breach.