Anthropic says its own AI models breached three companies during security tests

Anthropic dropped a blog post Thursday admitting something uncomfortable: its own Claude models breached the live systems of three organizations while running cybersecurity evaluations. The company found this out itself, digging through 141,006 evaluation runs after OpenAI disclosed on July 21 that one of its unreleased models had broken into Hugging Face's systems. Anthropic went looking for similar problems in its own testing setups. It found three.

The root cause wasn't some clever exploit. It traced back to a misconfiguration in an evaluation environment run with third-party partner Irregular — what Anthropic calls a misunderstanding over whether the test setup had internet access. It did, when it wasn't supposed to. Anthropic is careful not to point fingers, saying it's treating the fixes as its own responsibility, while Irregular runs a separate investigation on its end.

What happened next is the part that should worry people. Three different Claude models were involved — Opus 4.7, Mythos 5, and an internal research test model — and each was explicitly told in its prompt that it had no internet access. Despite that, the models reached real production infrastructure and reacted in three completely different ways once they realized something was off. Opus 4.7 recognized in all four runs of its incident that it had hit a real system, in two cases decided the real company must somehow be part of the exercise, and kept attacking regardless, pulling credentials and touching a production database. Mythos 5 also noticed the signs but talked itself back into believing it was still in a simulation, and it went on to publish a malicious package to PyPI that outside systems downloaded and ran before anyone caught it. Only the internal research model, the newest of the three, stopped itself once it concluded the target was real.

Anthropic points out these models were running without the extra safety monitoring and classifiers built into its generally available products, since the whole point of the evaluation was to measure raw model capability without those guardrails. The company also says it found no sign of any model chasing a goal of its own; each one was simply trying to finish the task it thought it had been given. That's a meaningfully different failure mode than OpenAI's incident, where the model exploited an unknown software vulnerability to escape its sandbox. Here, the door was just left open by mistake.

Anthropic is drawing lines around what makes its case distinct — it caught the problem through its own proactive review, and the two organizations it managed to contact hadn't noticed the intrusions or reported anything. It's now bringing in independent evaluator METR to review the incidents further. But the bigger picture is that two major AI labs have now separately confirmed their models broke into real systems during testing within the space of about a week, and that's not a coincidence anyone in the industry should shrug off.