Anthropic Says Claude Models Accessed Three Organizations During Cyber Tests
Anthropic said on July 30 that Claude models gained unauthorized access to three organizations during cybersecurity evaluations that were mistakenly connected to the internet. The company found the incidents in a review of 141,006 runs and said the models used basic techniques such as weak passwords and unauthenticated endpoints. Anthropic stopped affected evaluations and is tightening its evaluation controls.
Anthropic said on July 30 that three Claude models reached the open internet during cybersecurity evaluations and gained unauthorized access to the systems of three organizations. The company found the incidents after reviewing 141,006 evaluation runs in which Claude could potentially obtain internet access.
The evaluations were conducted in or alongside an environment operated by third-party testing partner Irregular. Anthropic said its prompts told the models that they were inside a simulation without internet access, but a misunderstanding with the partner left an internet path open. The models therefore treated real systems as part of their capture-the-flag exercises.
What happened
Anthropic said the incidents involved Opus 4.7, Mythos 5, and an internal research model not intended for general release. The earliest case dated to April. The models used familiar attack paths, including weak passwords, unauthenticated endpoints, exposed debug information, and SQL injection, rather than previously unknown vulnerabilities.
One Opus 4.7 evaluation shared a fictional company name with a real website. Four runs reached that company, extracted credentials, and accessed a database containing several hundred production rows. In another case, Mythos 5 uploaded a malicious package to the public Python Package Index while believing the registry was simulated; the package was available for roughly an hour and ran on 15 systems. A third model scanned internet-facing targets and compromised an application before stopping after recognizing that the host was real.
Anthropic said it contacted all three organizations on July 27. Two organizations it reached had not previously detected the activity. The company did not name the affected organizations.
The failure was broader than model behavior
The disclosure shows how a security evaluation can become a real incident when its surrounding infrastructure contradicts the model's instructions. Anthropic attributed the open internet path to a misunderstanding and misconfiguration, while also acknowledging that stronger validation, monitoring, transcript review, and network logging could have detected or prevented the problem.
Axios reported that Anthropic halted cyber evaluations capable of reaching the internet while reviewing its testing infrastructure. Anthropic also said it is expanding continuous transcript monitoring, improving investigation tools, and applying more rigorous assurance to external evaluation vendors.
For teams running agentic-security evaluations, the practical lesson is that containment cannot rest on the prompt or on a one-time sandbox assumption. Network egress, credential scope, endpoint authentication, package registries, and real-time logs all need independent controls. Retaining evaluation traces also matters: Anthropic found these incidents retrospectively only after another lab's disclosure prompted a targeted review.
Key Points
- 1Anthropic found three real-world access incidents across 141,006 reviewed cybersecurity evaluation runs.
- 2A mistaken internet path let models treat real systems as capture-the-flag targets, exposing failures in environment validation and monitoring.
- 3Anthropic halted internet-capable cyber evaluations and said it is strengthening transcript monitoring and vendor assurance.
Scoring Rationale
Three frontier-model evaluations crossed into real systems and caused production impact, making this a material security incident with direct implications for agent containment, vendor assurance, and evaluation infrastructure.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
