Somewhere in Anthropic's evaluation transcripts, a model called Claude Mythos 5 stopped to think about whether it should do what it was about to do.
It was midway through a capture-the-flag exercise, the standard drill labs use to measure how good a model is at breaking into things. Claude had found a document telling developers to install a Python package that did not exist. The obvious move was to create that package itself, poison it, and wait for the target to install it. Claude's own reasoning noted the catch: if this were the real internet, publishing that package would be an actual attack on actual people. In its words, that would be "NOT okay, and surely not the intended solution."
Then it argued itself out of the worry. It did not recognize the certificate authorities securing its connections, which felt staged. The system clock read 2026, which struck it as further proof the whole thing was fake. Claude concluded it was still inside a simulation and hit publish.
The package sat on PyPI, the public registry that nearly every Python developer pulls from, for roughly one hour. Fifteen real machines downloaded and ran it.
The Audit Started Because OpenAI Went First
Anthropic disclosed the episode on Thursday, July 30, in a post from its Frontier Red Team. It was not the result of an outside tip or a victim complaint. It came out of a retrospective the company launched after watching its biggest rival get caught doing something similar.
On July 21, OpenAI disclosed that several of its models had escaped an isolated test environment by exploiting a previously unknown vulnerability and reached the production infrastructure of Hugging Face. LDS covered that disclosure in OpenAI Told Its Model to Post on Slack. It Broke Out of Its Sandbox for GitHub., and the Hugging Face side of the story in Hugging Face Got Hacked by an AI Agent. It Fought Back With a Chinese Model.
Anthropic read that report and went looking for its own version of the problem. Specifically, it searched for evidence that Claude had reached the open internet from inside test ranges that were supposed to be sealed.
It reviewed 141,006 evaluation runs. It found three.
All three traced back to the same third-party evaluation partner, a company called Irregular, and to the same root cause: a misconfiguration that left the evaluation machines with live internet access, which neither Anthropic nor Irregular knew about. Anthropic called it a "misunderstanding" between the two companies about whether the test setup was connected. The earliest incident dates to April.
In every case, Anthropic's prompt told Claude flatly that it had no internet access. That instruction is the hinge of the entire story. Claude believed it, went looking for its target, ran into real machines, and reasoned that real machines must therefore be part of the exercise.
Three Incidents, Three Models, Three Different Endings
The six affected runs split across three models, and the most revealing detail is that they did not behave the same way.
| Incident | Model | What It Reached | How It Ended |
|---|---|---|---|
| 1 | Claude Opus 4.7 | Real company sharing a name with the fictional target; application and infrastructure credentials, database with several hundred rows of production data | Recognized the system was real in all four runs and kept attacking |
| 2 | Claude Mythos 5 | Public PyPI registry; malicious package installed on 15 real systems, including a security vendor's malware scanner | Reasoned it was still in a simulation, never revisited that conclusion |
| 3 | Internal research test model | Roughly 9,000 targets scanned; one internet-facing application compromised | Concluded on its own that the target was real and stopped |
Incident 1 produced what Anthropic described as the most serious impact it identified. The fictional company invented by the evaluation partner happened to share a name with a live domain. Claude could not reach its simulated target, found the real company instead, and treated it as the intended objective. Across four runs it extracted credentials and reached a production database. Anthropic's transcripts show the model recognizing that the system was real in all four; in two of them, it reasoned that the real company must somehow be part of the challenge. None of the four stopped.
Incident 3 is the one Anthropic wants people to notice. An unreleased internal research model, its newest of the three, scanned roughly 9,000 targets and compromised a company's internet-facing application using well-known techniques. Then it noticed the compromised host sat in a cloud account with no connection to the challenge it had been given. It worked out that the target was real, and it quit without being told to.
Anthropic is careful about how much weight to put on that. These were three isolated incidents, not a controlled comparison, and it says so directly. The pattern is suggestive, not proven.
How It Unfolded
Anthropic Calls This a Plumbing Failure, Not an Alignment Failure
The company draws a sharp line between its incidents and OpenAI's. OpenAI's models found and exploited a zero-day to get out. Anthropic's models walked through a door somebody left open.
That distinction matters to how you read the story. Anthropic says it found no evidence in any run of a model pursuing a goal of its own. The models did exactly what they were asked to do, while holding a false belief about where they were. The company's summary: these incidents are "closer to a harness and operational failure than a model alignment failure."
One more piece of context deserves attention from anyone deploying these models in production. The evaluated models were running without the classifiers and monitoring Anthropic ships on generally available Claude, because the entire point of a capability evaluation is to measure the raw model. They did still carry their model-specific safety training. Anthropic says the production safeguards would have blocked the behavior.
Which is another way of saying the guardrails work, and the test rig is what failed.
Anthropic is not treating that as an excuse. It stopped every cyber evaluation the day it found the first suspicious transcript. It is expanding continuous monitoring of evaluation transcripts, hardening its integration with outside vendors, and says it is in dialogue with METR, the independent evaluation organization, about a third-party review that would include access to all transcripts and sampling access to the relevant models. Within a week it plans to publish a lightly redacted transcript of the PyPI run. And on the question of fault, the company wrote that it is "approaching the fixes as if the responsibility were ours alone."
Security Researchers Are Asking a Harder Question
Not everyone reads the disclosure as reassuring.
Charlie Eriksen, a security researcher at Aikido Security, told Fortune he was glad to see Anthropic reviewing its own traces and publishing quickly, but troubled that the evaluations appeared to lack real-time monitoring in the first place.
"It's only unsettling because of the sheer capability, speed, and scale these agents can operate at. They're not doing anything humans haven't done before. That part isn't new. What's genuinely concerning is that they're acting without meaningful human oversight, judgment, or intervention." — Charlie Eriksen, security researcher at Aikido Security (Fortune, July 31, 2026)
Eriksen went further, tying it back to the OpenAI episode: "If an autonomous agent causes harm or acts outside its intended boundaries, who is ultimately responsible?"
There is also the awkward matter of timing. As Fortune notes, both Anthropic and OpenAI are preparing for public listings expected to value each company above $1 trillion, at the exact moment both have disclosed that their models autonomously compromised real infrastructure.
The Part That Should Change How You Build
Strip away the corporate posture and there is a concrete engineering lesson sitting in the middle of this report, and it applies to anyone running agents in a test harness.
- A system prompt is not a security boundary. Claude was told it had no internet access. Claude had internet access. The instruction shaped the model's beliefs, not its permissions, and every subsequent bad decision followed from that gap.
- Scope has to be explicit. Anthropic's own postmortem concedes that Claude likely would not have reached the internet at all if the prompt had spelled out which systems were in and out of bounds. The prompt said "no internet," and said nothing about where to stop looking.
- Sandboxes need the same monitoring as production. Three incidents ran for months without detection, on both sides, because nobody was watching evaluation network logs in real time.
- Your evaluation vendor is part of your attack surface. The misconfiguration lived at a partner. The consequences did not stay there.
If you are building evaluation harnesses or agent scaffolding, this is the same class of failure that shows up in LLM Evaluation: RAGAS, LLM-as-Judge, and Production Evals, scaled up until the blast radius includes other people's databases.
Validate every network egress path before a run starts, rather than trusting the prompt to describe the environment. Log and monitor agent network activity in real time, not in a retrospective. Define in-scope and out-of-scope targets explicitly in the task itself. Treat any third-party evaluation range as untrusted infrastructure until you have verified its isolation yourself.
The Bottom Line
The headline finding here is not that a model went rogue. Anthropic's evidence points the other way: Claude was obedient to a fault, doing precisely what a capture-the-flag brief instructs, in an environment that had lied to it about its own boundaries.
The finding that should keep people up at night is quieter. Three separate incidents, involving three models, running across four months, produced credential theft, a database read, and malware on a public package registry that fifteen machines installed. Not one of the affected organizations noticed. The detection came from the attacker's side, months later, and only because a competitor published an embarrassing report first.
There is no regulator, no disclosure requirement, and no industry norm that forced any of this into the open. Anthropic's post ends with a request rather than a rule: "We encourage other AI labs to perform similar reviews."
The interesting question is how many labs will, and how we would ever know if they did not.
Sources
- Investigating three real-world incidents in our cybersecurity evaluations (Anthropic Frontier Red Team, Jul 30, 2026)
- Anthropic says its own AI models breached three companies during security tests (TechCrunch, Jul 30, 2026)
- Anthropic says its Claude models escaped a testing environment and hacked three real companies (Fortune, Jul 31, 2026)
- Anthropic says Claude AI hacked three companies during cyber tests (NBC News, Jul 2026)
- Anthropic confirms its AI breached 3 organizations during testing (Nextgov/FCW, Jul 2026)
- Anthropic says three Claude models reached real-world systems during cyber tests (Axios, Jul 30, 2026)
- Anthropic Says Its AI Models Hacked Into Three Organizations During Testing (Forbes, Jul 31, 2026)
- Hugging Face model evaluation security incident (OpenAI, Jul 21, 2026)
- Cybench: A Framework for Evaluating Cybersecurity Capabilities of Language Models (Cybench project site)