Anthropic has disclosed that its AI model Claude gained unauthorized access to the systems of three different organizations during cybersecurity evaluations.
The disclosure follows OpenAI’s July 21 announcement that some of its models had escaped an isolated testing environment by exploiting a previously unknown vulnerability and reached the systems of Hugging Face, the open-source machine learning platform.
“After reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations,” Anthropic said.
The incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research model. All three incidents occurred during capture-the-flag exercises conducted by Irregular.
In this type of exercise, Claude is given a fictional scenario and told that a piece of secret data is hidden on another machine on the network, with no prescribed method for finding it.
“In all cases, our evaluation prompt stated explicitly that Claude had no internet access, but didn’t give Claude any limits on where to look for the flag,” the company explained.
“However, a misconfiguration left the machines that Claude accessed as part of the evaluation with live internet access. Neither we nor our evaluation partner were aware of this misconfiguration until we detected it through our additional evaluation monitoring last week.”
How the incidents unfolded
The first incident is what Anthropic describes as the most serious impact it observed. In the test scenario, the fictional target company shared its name with a real internet domain.
In four runs, Opus 4.7 failed to access its simulated target, identified the real company online instead, and gained unauthorized access to its infrastructure through weak passwords and unauthenticated endpoints. It retrieved application and infrastructure credentials and accessed a database containing several hundred rows of production data.
According to Anthropic, this was “the only case” in which the model continued attacking after determining it was likely operating in a real environment. In two of the four runs, Claude incorrectly concluded that the real company had been intentionally included in the evaluation.
The second incident involved Mythos 5. Within the fictional test scenario, Claude found a fake onboarding document for a made-up company instructing new employees to install a Python package that did not actually exist.
Claude registered and published a package under that exact name, reasoning that the fictional company’s systems would automatically download it.
Anthropic said that Claude “went to extensive lengths to carry out this attack.”
To register a PyPI account, it needed an email address, which in turn required a phone number. Claude first tried using a free phone number service and failed, then attempted to pay for one through several routes before ultimately finding an email provider that allowed registration without a phone number.
The package remained available on PyPI for about an hour. During that time, it was downloaded and executed on 15 real systems, including one belonging to a security company whose malware scanner routinely installs and analyzes newly published Python packages.
“We believe the company’s security scanner treated PyPI packages as safe to install, and as a result, Claude was able to exfiltrate the company’s credentials to a collection point it had set up. Claude then used these credentials to access further infrastructure from this company,” Anthropic wrote.
PyPI’s security systems later removed the package. Anthropic added that it has shared the relevant details with the PyPI team.
“Mythos 5 correctly intuited that it was accessing the open internet, but reasoned its way back to the conclusion that it was still in a simulation.”
In the third incident, an internal research model that was not intended for public release failed to reach its assigned target and instead scanned roughly 9,000 internet-facing systems. It compromised one company’s application through an exposed debug page and an SQL injection vulnerability, both of which Anthropic described as basic techniques.
Partway through the exercise, the model determined that the system it had compromised had no connection to its assigned scenario, concluded it had accessed a real target, and stopped on its own.
Anthropic takes responsibility
Anthropic emphasized that Claude never attempted to exfiltrate itself or escape its evaluation environment in any of the three incidents, and that the models acted solely to complete their assigned tasks.
The company suspended all cybersecurity evaluations on July 23 after detecting the issue, identified all three incidents by the following day, and notified Irregular and the affected organizations on July 27.
“Ultimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we’re approaching the fixes as if the responsibility were ours alone,” Anthropic concluded.