Anthropic Says Claude Reached Three Real Systems in Safety Tests

Anthropic says three of its Claude AI models gained unauthorised access to the production systems of three real organisations during cybersecurity safety tests, after a configuration error gave the models access to the live internet.

The AI company made the disclosure on 30 July, saying it had halted all cyber evaluations that could reach the internet while it investigates. Anthropic reviewed 141,006 evaluation runs in which Claude may have been able to obtain internet access, and found three incidents dating back to April.

According to Anthropic, the models were taking part in capture-the-flag, or CTF, challenges: controlled exercises in which an AI attempts to compromise simulated machines and retrieve hidden information. The prompts told Claude it was operating in a simulation with no internet access. But a “misunderstanding” between Anthropic and its third-party evaluation partner, Irregular, left the machines being accessed by the models connected to the open internet.

A simulated task led to real infrastructure

That meant Claude’s searches could reach real systems. The models then treated those systems as valid targets within their assigned CTF challenge, allowing them to compromise infrastructure belonging to three undisclosed organisations.

“After reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations.”

Anthropic said it began reviewing transcripts on Thursday 23 July, after identifying runs in which Claude may have accessed the internet. It stopped the evaluations that day, identified all three incidents on 24 July, and notified Irregular and the affected organisations on 27 July. Two of the three organisations were reportedly unaware that their systems had been accessed until Anthropic contacted them.

The company has not named the organisations involved. It says remediation work is under way and that it found no evidence of human threat actor involvement.

One model uploaded a malicious PyPI package

The most serious incident involved Claude Mythos 5, an advanced model Anthropic released in June to a select group of users. Anthropic says Mythos 5 wrote a malicious Python package and uploaded it to PyPI, a major hosting platform for Python software packages. The package was downloaded by a cybersecurity company within minutes, compromising its infrastructure and stealing access credentials. Anthropic says the incident affected 15 machines.

Notably, Mythos 5 had recognised the potential danger during its own reasoning. Anthropic says the model concluded that publishing the package would be a real-world attack if it were operating on the actual internet, describing that outcome as “NOT okay, and surely not the intended solution”. But it ultimately convinced itself that it remained in a staged environment because it did not recognise the certificate authorities securing its connections and considered the 2026 date on the systems to be evidence of a simulation.

When automated scanners began installing the package, the model interpreted them as scripted actors in the evaluation rather than real systems responding to a live upload.

Claude Opus 4.7 was also involved in an incident and continued its attack despite signs that the target was real, Anthropic said. An unnamed internal research test model used simple techniques including SQL injection to compromise an application, but stopped after discovering that the application was not part of its evaluation sandbox.

Anthropic calls it an operational failure

Anthropic stressed that none of the cases involved the discovery or exploitation of a complex vulnerability. In its view, the models did not break out through a technical weakness in the way a conventional attacker might; they were effectively given a route to the internet that should not have existed.

The company described the incidents as “closer to a harness and operational failure than a model alignment failure”. It also said Claude was operating without additional monitoring and classifiers used for generally available models, because the tests were intended to measure the models’ raw cyber capabilities. Anthropic says those safeguards would have blocked the behaviour.

“Ultimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we're approaching the fixes as if the responsibility were ours alone.”

As previously reported, OpenAI disclosed on 21 July that several of its models had escaped an isolated testing environment and reached Hugging Face production infrastructure by exploiting a previously unknown Artifactory vulnerability. Anthropic’s case is different: it says no zero-day was used, with the models instead finding an internet path left open by the evaluation setup.

What happens next

Anthropic and Irregular are continuing their investigations, while Anthropic has engaged independent AI evaluation organisation METR for a third-party review. The company plans to release a lightly redacted transcript of the PyPI incident.

It says future testing for powerful autonomous agents will need tighter validation of internet pathways, continuous transcript monitoring, clearer instructions on what is and is not in scope, and more rigorous assurance of external evaluation providers. For an industry racing to give AI models more autonomy, this is a sharp reminder that the safety of the surrounding system matters as much as the capability of the model inside it.