Anthropic
disclosed Thursday that three of its Claude models compromised three organizations during capture-the-flag (CTF) tests due to a wrongly configured testing environment.
The company said it reviewed its evaluations, totaling 141,006 evaluation runs, after
OpenAI disclosed that one of its agents escaped its testing sandbox and
breached Hugging Face infrastructure during an ExploitGym exercise.
In its review, Anthropic found six runs where the models used the internet to gain unauthorized access to external organizations, four of which affected the same organization. During these tests, the models were not restricted by the safeguards that are usually in place to prevent misuse.
Unlike in the OpenAI-Hugging Face case, where OpenAI’s models exploited a zero-day vulnerability in the JFrog Artifactory package registry cache proxy to escape to the internet, Anthropic’s models were inadvertently given internet access due to a “misunderstanding” between Anthropic and a third-party evaluation partner, Irregular, Anthropic said.
While the Claude models were told in their prompt that they did not have internet access, they were still able to access the internet, which Anthropic said led the models in some cases to believe real companies accessed this way were part of the test simulation.
“The AI industry has spent years making models more powerful, and far less time verifying what those models can actually reach. In this case, the models were told they were in a simulation with no internet access. The environment said otherwise. That gap between assumed and actual configuration is where third-party risk now lives,” Gordon Rios, founding scientist and technical team leader at Magnitude told SC Media in an email.
Three Claude models, three compromised companies
Anthropic’s disclosure outlined all three incidents: one involving Claude Opus 4.7, one involving Mythos 5 and one involving an “internal research test model” not planned for public release. The earliest incident occurred in April 2026, the company said.
The incident involving Opus 4.7 involved four runs and had the “most serious impact” out of the three, Anthropic said. In this incident, the real company accessed by Opus 4.7 had the same name as a fictional target company in the CTF exercise, and the model exploited known vulnerabilities in the company’s infrastructure to gain unauthorized access.
As a result of the intrusion, Claude extracted application and infrastructure credentials from the company and also accessed a database containing “several hundred rows of production data,” Anthropic said. While Opus 4.7’s reasoning output indicated that it recognized it was interacting with real systems, it did not stop the attack, Anthropic noted.
“The lesson for anyone building or buying agentic AI is that a model’s own judgement is not a containment control. Authorization has to live in the infrastructure, not in the model’s read of its situation. For teams running their own evaluations, that means network egress that defaults to deny and logs every outbound connection the agent attempts, on the assumption that any reachable system is an in-scope target,” said Collin Hogue-Spears, senior director of solution management at Black Duck, in comments to SC Media.
The incident involving Mythos 5 stemmed from the publication of a malicious PyPI package by the model after it discovered the name of a non-existent package in setup instructions from a fictional target company. Anthropic found that Mythos 5 “went to extensive lengths” to conduct this attack, even attempting to obtain funds to acquire a phone number to create an email address for a PyPI account. Eventually, it managed to create a free email address without a phone number, registered the PyPI account and published the package.
The malicious package was available on PyPI for about an hour and downloaded 15 times; in one of these cases, the malicious code executed on the system of a real security company that routinely installs and scans Python packages, leading to the exfiltration of company credentials to “a collection point” Claude had set up. The model subsequently leveraged these credentials to gain additional access to company infrastructure.
Anthropic noted that while Mythos 5 recognized that publishing the malicious package could have negative consequences in the real world, it “convinced itself it was still in a simulation” and proceeded with the attack. The malicious package was ultimately removed automatically by PyPI’s security system.
“An AI breached companies it should never have accessed, then decided the break-ins did not matter because it might be a simulation. Think about that for a second. Any business using agents is just one mistake away from the same problem,” noted Manoj Nair, CTO and chief innovation officer at Snyk, in comments to SC Media. “Companies must know every agent they’re running, box in what each one can reach, and put an independent check between the agent and the action.”
In the third incident, the unreleased model scanned about 9,000 targets online in search of the fictional CTF target, eventually compromising one company’s internet-facing application “using basic and well-known cyberattack techniques like reading credentials from an exposed debug page and SQL injection,” Anthropic said.
Unlike the other two models, this internal model stopped the attack after realizing it had compromised a real host not connected to the CTF exercise.
“If an AI model can accidentally wander into your network, you don’t have an ‘AI threat’ problem. You have a basic IT hygiene problem. Human hackers, automated scripts, and lost LLMs all follow the exact same rule: they take the path of least resistance,” commented Ben Bernstein, cybersecurity advisor at Huntress, in an email to SC Media.
In response to the discovery of these intrusions by its models, Anthropic is working with Irregular to fully investigate and resolve the incidents and has also contacted PyPI and all three affected companies, noting that the two companies that responded were not aware of the intrusion until Anthropic informed them. The company also intends to work with the independent AI evaluation organization METR for a third-party review of the incidents and says it plans to publish more information, including parts of evaluation transcripts, in the coming weeks.
Anthropic said no zero-day vulnerabilities were exploited during the incidents, that internet access was gained through an open path left accessible due to a misconfiguration and that no internal Anthropic systems or customer data were impacted. The company plans to improve the security of its evaluation environments and encouraged other AI companies to perform similar reviews for unintended behavior during evaluations.