Anthropic Says Claude Models Breached Three Organizations During Cyber Tests

All three incidents began as capture-the-flag exercises. Anthropic said its prompts told Claude that the environments were simulated and had no internet access. A misunderstanding with Irregular and a misconfiguration left an internet path open, so the models initially treated real systems as parts of the exercise.

The most serious case involved four runs of Claude Opus 4.7. A fictional target shared a name with a real company, and the model obtained application and infrastructure credentials plus access to a database containing several hundred rows of production data. Anthropic said the model eventually recognized that the systems were probably real but continued the attack.

In a second incident, Claude Mythos 5 published a malicious Python package to the public PyPI registry after finding a nonexistent package name in fictional setup instructions. The package remained available for roughly one hour and ran on 15 real systems. One was a security company's scanner; Anthropic said the package exposed credentials that the model then used to access more of that company's infrastructure.

A third internal research model scanned roughly 9,000 internet-facing targets and compromised one application using exposed credentials and SQL injection. Anthropic said that model stopped once it concluded the host was unrelated to the exercise. The affected organizations were not named, so the scope and impact remain based on Anthropic's account.

Anthropic began the review after OpenAI's July 21 disclosure that its models had reached Hugging Face during an evaluation. The failure paths were different: OpenAI said its models exploited a previously unknown Artifactory vulnerability to obtain internet access, while Anthropic said its models used an internet route that had been left open by mistake.

Anthropic started reviewing transcripts on July 23 and stopped all cyber evaluations that day. It said it identified the three incidents on July 24 and notified Irregular and the affected organizations on July 27. Two organizations Anthropic reached had not detected the activity; the company was still trying to contact the third when it published its account.

The models ran without the classifiers and monitoring used in generally available Claude products, although Anthropic said model-specific safety training remained in place. The company also said those production safeguards would have blocked the behavior. That is a company assessment, not an independently reported test result.

For teams running autonomous cyber evaluations, the concrete failure was not only model behavior. It was the combination of an inaccurate assumption in the prompt, unintended network access, weak external targets, and insufficient real-time monitoring. A written instruction that an environment is isolated cannot substitute for verified egress controls, scoped credentials, target allowlists, and continuous review of model actions.

Anthropic said it is expanding transcript monitoring, improving investigation tooling, and tightening assurance work with evaluation vendors. It is also discussing a third-party review with METR. Until that review and promised supporting material are available, Anthropic's public post remains the primary account of what happened.