Anthropic says a review triggered by OpenAI’s recent disclosure found three real-world intrusions caused by a misconfigured AI testing environment.
Less than two weeks after OpenAI disclosed that an experimental AI model breached Hugging Face during a cybersecurity evaluation, Anthropic has revealed that its own review uncovered three incidents in which Claude models gained unauthorized access to the production infrastructure of three organizations during similar testing.
Anthropic said it launched the review after OpenAI disclosed that one of its experimental models had escaped its evaluation environment.
“After reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations,” Anthropic said in a blog post.
The company, however, did not name the three organizations. It also did not immediately respond to a request for comment.
The disclosure makes Anthropic the second frontier AI developer in recent weeks to report autonomous AI models interacting with real-world production systems during pre-release cybersecurity testing.
Anthropic said its incidents stemmed from a misconfigured evaluation environment that allowed internet access, while OpenAI attributed its incident to an experimental model exploiting a previously unknown vulnerability to escape its testing environment.
Misconfigured evaluation environment exposed real-world systems
Anthropic said the incidents occurred during capture-the-flag exercises designed to measure Claude’s offensive cyber capabilities. The company said it believed the evaluation environment was isolated from the public internet but later discovered that internet access had been available because of a misunderstanding with its third-party evaluation partner.
“Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise,” Anthropic said.
Anthropic said three different models — Claude Opus 4.7, Mythos 5, and an internal research model — were involved in incidents that occurred in April.
Anthropic said the most serious incident involved Claude Opus 4.7 exploiting vulnerabilities at a real company whose domain matched the fictional evaluation target, allowing the model to obtain application credentials and access a production database.
“In four runs of this evaluation, Claude ran into difficulty reaching its simulated target within the evaluation environment, but then discovered that the real company was reachable via the internet,” the blog post added. “Assuming this was the intended target in the capture-the-flag task, Claude sought, identified, and exploited vulnerabilities within the company’s infrastructure, believing it to be part of the exercise… This represented the most serious impact we identified.”
In a second incident, Anthropic said Claude Mythos 5 published a malicious Python package to the public PyPI repository while attempting to compromise a simulated target. The package remained publicly available for about an hour and was downloaded and executed on 15 real systems before it was removed, according to the company.
The third incident involved an internal research model scanning roughly 9,000 internet-facing hosts before exploiting exposed credentials and SQL injection to access a real company’s application. According to Anthropic, the model later recognized it had reached a production environment and abandoned the exercise.
Vibhum Dubey, a cybersecurity researcher and red teamer, said the PyPI incident may have the biggest implications for enterprise defenders because the affected organization was compromised through a routine security process rather than a vulnerable application. “The second one is honestly the more interesting story—it got compromised because its own security scanner did exactly what it’s supposed to do, automatically install and scan a new Python package, except the package was one Claude had built and uploaded as part of the test,” Dubey said. “So a company got breached by following good security practice, which is a pretty uncomfortable detail.”
Anthropic distinguishes incidents from OpenAI’s
Anthropic said its findings differed from OpenAI’s recent disclosure because its models did not exploit a software vulnerability to escape isolation.
“Whereas OpenAI’s models exploited a novel vulnerability to escape isolation, the Claude models evaluated here accessed the internet via an open path. While there is not a perfectly sharp distinction between the two, we believe these incidents to be closer to a harness and operational failure than a model alignment failure,” the company said in the blog post.
Anthropic also said the behavior of its newest research model offered “cautious optimism” because it recognized that it had reached a real-world environment and stopped pursuing the evaluation objective.
Dubey said the two disclosures point to a broader issue with how frontier AI models are being evaluated.
“This is the second major AI lab in about two weeks to admit a test environment leaked out to the real internet,” he said. “That’s not really a coincidence anymore. It points to eval environments being treated as lower priority than production systems, even though the whole point of these tests is to see how far a model can push offensive capability with fewer guardrails on.”
Security experts urge stronger evaluation safeguards
The Anthropic and OpenAI disclosures highlight shortcomings in the environments used to evaluate increasingly capable AI models, according to Drew Dennison, co-founder and CTO at Semgrep.
“What is surprising is that labs taking safety this seriously still don’t have a ‘Fort Knox’ testing sandbox designed to contain models this capable,” Dennison said.
He added that while AI developers are likely to strengthen their evaluation environments, organizations should prepare for similar capabilities becoming available to attackers.
“The industry will shut this kind of activity down, but that won’t stop malicious actors from gaining access to models of this caliber within the next six months and deliberately attempting the same thing,” Dennison said. “Defenders have a limited window to prepare, which makes hardening their software attack surface now so critical.”
Anthropic said the review has prompted changes to how it conducts cyber capability evaluations.
“Evaluation environments that involve powerful autonomous capabilities also require significant controls. Safety testing happens before a model is released precisely because we don’t yet know what it is capable of. Evaluation environments increasingly need to be held to the same security standard as any other system our models run in,” the company added in the blog post.