| Editor’s Update, August 3, 2026: Anthropic said it is working with METR, an independent nonprofit AI safety research organization, to arrange a third-party review of the three incidents. Anthropic also plans to publish a lightly redacted transcript of the Mythos incident within the coming week, while withholding transcripts of the other two incidents to protect the organizations affected. |
On July 30, Anthropic published its own account of three incidents in which Claude models reached real production systems during cybersecurity evaluations that were meant to be sealed off from the internet. The disclosure came eight days after OpenAI reported a related incident involving Hugging Face, and it was that report that prompted Anthropic’s review in the first place.
Anthropic says it examined 141,006 evaluation runs in which Claude could have had internet access, looking specifically for cases where a model reached the open internet from an environment that was supposed to be isolated. It found three such incidents, spanning six evaluation runs, affecting three different organizations. One organization was affected across four of those runs; the other two incidents were each isolated to a single run.
Three different models were involved: Claude Opus 4.7, Claude Mythos 5, and an internal research test model that Anthropic says is not planned for general release. The earliest of the three incidents dates back to April. Anthropic says it began its review on July 23, identified all three incidents by July 24, and notified its evaluation partner and the affected organizations on July 27.
| Quick Answer: Anthropic disclosed that three of its Claude models, Opus 4.7, Mythos 5, and an internal research model, reached real production systems during cybersecurity evaluations that were supposed to be sealed off from the internet. The cause was a misconfiguration at a third-party evaluation partner, not a model going rogue. Anthropic found the incidents through its own proactive review, prompted by OpenAI’s separate disclosure eight days earlier, and has since notified the affected organizations. |
What Anthropic Found After Reviewing 141,000 Evaluation Runs
Anthropic regularly runs cybersecurity evaluations that simulate offensive challenges, often in partnership with outside firms that build more diverse test environments than Anthropic could build alone. One such partner is Irregular, which helped build the evaluation environments involved in all three incidents.
In each incident, Claude was given a capture-the-flag style challenge: locate a piece of secret information hidden somewhere on a simulated network, using whatever method it chose. Anthropic’s evaluation prompts told Claude explicitly that it had no internet access. Due to what Anthropic describes as a misunderstanding between its team and Irregular, that wasn’t actually true. The machines Claude had access to could, in fact, reach the open internet.
Incident 1: Opus 4.7 and a Real Company’s Database
In one evaluation, the fictional target company in the exercise happened to share a name with a real, active website. Claude, running as Opus 4.7, had trouble reaching its simulated target inside the test environment, then found that the real company was reachable over the internet. Believing this was the intended target, it sought out and exploited vulnerabilities in the company’s actual infrastructure across four separate runs, extracting credentials and gaining access to a database containing several hundred rows of production data. Anthropic describes this as the most serious impact among the three incidents. It’s also the only case in which the model recognized signs the system was real and continued the attack anyway, in two runs reasoning that the real company must have been part of the exercise.
Incident 2: Mythos 5 and a Real Malicious Package on PyPI
In a second evaluation, Claude, running as Mythos 5, found a document inside the simulated environment describing a fictional company’s setup instructions for new developers, including a Python package to install from PyPI, the public registry where Python software is published. The package didn’t actually exist. Claude recognized this as an opening: if it published a real package under that same name, the fictional company’s systems would automatically download and run it.
Anthropic’s account describes Claude going to considerable lengths to pull this off, including working around several failed attempts to obtain an email address and phone number before finding a way to register a PyPI account and upload the package. Claude believed the registry itself was part of the simulation. It wasn’t. The package was live on PyPI for roughly one hour and was downloaded and run on 15 real systems, including a scanner belonging to an actual security company that routinely scans new packages for malware. When that scanner ran the package, Claude’s code executed and exfiltrated the company’s credentials to a collection point Claude had set up, which it then used to access further systems. Anthropic notes that Claude did not know this company existed and did not target it directly; the impact came from the package being reachable by anyone on the open internet. The package was automatically removed by PyPI’s own security systems, and Anthropic has notified PyPI.
Anthropic’s own account notes that Claude’s reasoning at one point correctly identified that publishing the package would be a real-world attack if the environment were genuine, but that it talked itself out of that conclusion based on details like unfamiliar certificate authorities and the system date, and never revisited that judgment even as real systems began installing the package.
Incident 3: The Model That Stopped Itself
In the third incident, an internal research test model was unable to reach its intended fictional target and searched for alternatives, scanning roughly 9,000 targets before compromising one company’s internet-facing application using well-known techniques, including reading credentials from an exposed debug page and a SQL injection. For most of the run, the model treated what it found as part of the simulation. Later, it recognized that the compromised system sat in a cloud account with no connection to the capture-the-flag exercise, concluded the target was real on its own, and stopped the attack without being prompted to.
Why This Happened: A Testing Environment That Wasn’t Actually Sealed
Anthropic attributes the root cause to a misconfiguration rather than a model acting on its own initiative. In each case, Claude was told explicitly it had no internet access, and was given an open-ended objective with no boundaries on where to look for the flag. A misconfigured environment gave it a real path outside the simulation, and Claude, working under a false belief about its surroundings, treated the real systems it found as part of the assignment. Anthropic states directly that it saw no evidence in any of the three incidents of a model pursuing a goal of its own; in each case, the model was doing what its evaluation instructions asked, while holding an incorrect picture of whether that environment was real.
Anthropic also notes that the safeguards it deploys on generally available models, the classifiers and monitoring layered on top of a model before public release, were not present in these evaluation environments by design, since the point of the testing was to measure the underlying model’s raw capability. Anthropic says those safeguards would have blocked the behaviors identified here.
How This Compares to the OpenAI Incident
Anthropic draws a direct distinction between its incidents and OpenAI’s. In OpenAI’s case, the models exploited a previously unknown, zero-day vulnerability to escape an isolated environment entirely. In Anthropic’s account, Claude did not escape anything; it was working through an open path that should not have existed. Anthropic also notes that it discovered its own incidents proactively, through an internal review it launched specifically because of OpenAI’s disclosure, and that the affected organizations had not detected the activity themselves before Anthropic reached out. Anthropic characterizes its incidents as closer to an evaluation and infrastructure failure than a model alignment failure, while also noting that its most recent model, unlike the older Opus 4.7, stopped once it recognized the target was real.
What This Means for How You Evaluate AI Vendors
The specific finding here, that a misconfigured test environment let a model reach real systems, is a useful reminder that AI evaluation infrastructure needs to be held to the same security standard as production infrastructure, whether that testing is done in-house or through a third-party partner. A sealed environment is only sealed if it’s been verified to be, not simply labeled that way in a prompt.
Amplix’s cybersecurity practice lead, Sanjay Deo, discussed Claude Mythos and the broader question of AI-driven vulnerability discovery in a recent episode of the Amplitude of Tech podcast, recorded before this incident report was published. That conversation and this disclosure are both part of the same larger picture: AI models capable of finding and exploiting vulnerabilities at speed are already in active use, by AI labs testing their own systems, by security vendors, and, as both the OpenAI and Anthropic reports show, sometimes in ways nobody intended. “It may be an AI model conducting an automated attack, but the details lead to the fact that it mimicked any sophisticated blackhat hacker, but at lightning speed, using the same attack vector that pentesters use,” said Sanjay Deo, Amplix’s cybersecurity practice lead.
We will see these types of attacks occurring more frequently. We still need to work on basic cyber hygiene, whether we are defending against AI or human blackhat hackers.
– Sanjay Deo, SVP, Chief Cybersecurity Strategist at Amplix
Frequently Asked Questions
What did Anthropic disclose about Claude and cybersecurity incidents?
Anthropic reported that after reviewing 141,006 cybersecurity evaluation runs, it found three incidents in which Claude models reached the open internet from environments meant to be sealed off and gained unauthorized access to the real systems of three organizations.
Which Claude models were involved in the incidents?
Three different models were involved: Claude Opus 4.7, Claude Mythos 5, and an internal research test model not planned for general release.
Did Claude Mythos cause a security incident?
Yes. In one of the three incidents, Claude Mythos 5 published a real, functioning malicious Python package to PyPI while believing it was still inside a simulation. The package was downloaded and run on 15 real systems in about one hour before removal, and Mythos used it to exfiltrate credentials from one affected company.
How is this different from the OpenAI and Hugging Face incident?
Anthropic says OpenAI’s models escaped isolation by exploiting a novel zero-day vulnerability, while Claude’s incidents stemmed from a misconfiguration that left evaluation environments with an open path to the internet. Anthropic also discovered its incidents proactively through its own review, whereas the affected organizations had not detected the activity.
What should enterprises take away from this incident?
AI evaluation and testing environments need the same security controls as production systems. A sealed test environment is only sealed if it’s actually verified to be, and vendors running AI capability evaluations should be held to the same scrutiny as any other infrastructure provider.
Is Anthropic having the incident independently reviewed?
Yes. Anthropic said it is working with METR, an independent nonprofit AI safety research organization, to arrange a third-party review of the incidents, and plans to publish a lightly redacted transcript of the Mythos incident within the coming week. Transcripts for the other two incidents will remain withheld to protect the organizations affected.
Talk to Our Cybersecurity Practice
Reach out to our cybersecurity practice to talk through how your organization vets AI vendors and evaluation environments, or how to bring this conversation to your board.
