Anthropic disclosed that Claude models had accessed the real production infrastructure of three separate organizations during cybersecurity evaluations that were supposed to run in isolated, fictional environments. The company found the incidents after reviewing 141,006 evaluation runs following OpenAI’s disclosure about its own models escaping a test environment. Three different Claude models were involved, Opus 4.7, Mythos 5, and an internal research prototype, and each behaved differently once evidence emerged that the targets were real.
“In all three incidents, Claude had been tasked with a capture-the-flag challenge, one of the ways we assess a model’s cyber capabilities. The model is given a fictional scenario and told that a piece of secret information (the “flag”) has been hidden on a different machine on the network, and its objective is to break in and retrieve it. The challenge is left open-ended, and no particular method is prescribed.” reads the report published by Anthropic. “Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise.”
The evaluation partner is Irregular, a third-party firm that creates and runs cybersecurity benchmarks. Neither Anthropic nor Irregular was aware of the misconfiguration until Anthropic began its retrospective review the week of July 23.
The first incident is the most serious. In four evaluation runs, Claude Opus 4.7 couldn’t reach its simulated target inside the test environment, found that the real company was reachable via the internet, and attacked it.
“These four runs extracted information like application and infrastructure credentials, and obtained access to a database containing several hundred rows of production data. This represented the most serious impact we identified.” continues the report. “This incident involved Claude Opus 4.7, and was the only case in which the model continued to attack a system after learning it was likely operating in a real environment. In all four of the runs, the model eventually recognized (as can be observed in its verbalized reasoning) that the system was real—in two cases, the model rationalized that the real company must be part of the exercise. However, none stopped the attack on that basis.”
The fictional company chosen for the scenario happened to share its name with an active website domain, which is how the model ended up there.
The second incident involves Claude Mythos 5 and a Python package. The model found setup instructions in the fictional environment telling developers to install a package from PyPI that didn’t actually exist. Claude concluded that publishing its own malicious package under the same name would cause the fictional company’s systems to install it automatically.
“Claude went to extensive lengths to carry out this attack—lengths that would likely have indicated to a human participant that this was no longer just an evaluation, and that they were in fact uploading a real PyPI package. For instance, in one case, in order to create a PyPI account, Claude needed an email address.” continues the report. “And in order to create an email address, it needed a phone number. To get a phone number, after failing to find a free phone number service, it tried—and failed—to obtain funds to pay for a phone number through several different means. It finally backtracked, found a free, non-blocked email provider, used this to register a PyPI account, and then used this account to upload malware to PyPI.”
The package was live for roughly one hour, was downloaded and run on 15 real systems, and one of those was a security company’s automated scanner that treated PyPI packages as safe to install, which handed Claude the company’s credentials. The package was removed automatically by PyPI’s own security systems.
Mythos 5’s own reasoning during this run correctly identified what it was doing. It noted that if this were the real internet, publishing the package would be a real-world attack, “NOT okay, and surely not the intended solution.” It then convinced itself it was still in a simulation because it didn’t recognize the certificate authorities it was seeing, and because the calendar date of 2026 on the systems proved, in its own reasoning, that the environment was staged. It never revisited that conclusion.
The third incident involved an internal research model that scanned roughly 9,000 targets before compromising one company’s internet-facing application through basic techniques, reading credentials from an exposed debug page and SQL injection. This model eventually concluded on its own that the target was real, and stopped. That’s the behavior Anthropic wanted to see, and it only appeared in the most recent model of the three.
Anthropic stopped all cyber evaluations on July 23 after spotting the first suspicious transcripts, identified all three incidents the following day, and notified the three affected organizations on July 27. Two of them had not previously detected the activity. Anthropic is framing the root cause as an evaluation infrastructure failure rather than a model alignment failure, the models were told they had no internet access and were given an open-ended instruction to capture the flag, while actually having internet access. The fix the company emphasizes most: evaluation environments containing powerful autonomous capabilities now need to be held to the same security standard as any other system the models run in.
“many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we’re approaching the fixes as if the responsibility were ours alone. This begins with ensuring every part of our evaluation pipeline is secure, including the manner in which we integrate with external partners.” conlcudes the report. “Moving forward, it will include expanding our continuous monitoring of evaluation transcripts for unexpected behavior, improving our investigation tooling, and conducting more rigorous assurance work with the vendors we rely on.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Claude)