Anthropic revealed on Thursday that some of its Claude models escaped test environments and hacked into the systems of three organizations while trying to solve a challenge.
The admission comes after OpenAI revealed that its models broke out of what was believed to be an isolated environment and breached Hugging Face and other organizations.
Anthropic decided to conduct its own investigation after the OpenAI incident came to light, reviewing 141,000 evaluation runs where Claude could have gained internet access.
The analysis revealed three instances where a model reached the public web either from within or while interacting with an environment set up by Irregular, an Israeli AI security startup that serves as one of Anthropic’s third-party evaluation partners.
The models that broke out from the testing environment then breached the production systems of three unnamed organizations, with the earliest intrusion dating to April.
According to the AI giant, Claude had been tasked with conducting a capture-the-flag challenge to assess its cyber capabilities.
The breakout from the sandbox occurred due to a misunderstanding between Anthropic and Irregular—Anthropic told Claude that it was conducting a simulation in an environment without internet, but a connection to the internet was in fact available and the models treated it as part of the exercise. The AI then also falsely believed that the organizations it targeted were part of the exercise.
Anthropic claims this is the only reason why its models conducted real-world attacks, and it was never their intention to escape the test environment.
Unlike in the OpenAI incident, which involved the exploitation of a JFrog product zero-day, the hacking conducted by Claude models leveraged weak credentials, unauthenticated endpoints, and other basic attack techniques.
The real-world attacks
Anthropic said the incidents involved Mythos, Opus, and an internal research model, all running without the safeguards deployed when they are made available to customers. The internal model, which the company described as its “latest”, stopped the exercise when it realized that it had breached a real company.
In the first incident, Claude Opus 4.7 continued to attack the system even after learning that it was operating in a real environment rather than a test environment, believing that the hacked company was part of the evaluation. The model targeted the company because its website domain name resembled the name of the fictional target company set up for the test.
In the second incident, Mythos 5 gained access to the systems of a cybersecurity company after deploying a malicious Python package to PyPI. The security firm regularly scans Python packages and it installed the malicious package, which enabled the AI to exfiltrate credentials and access the company’s infrastructure.
This incident demonstrates the complexity of the actions AI models can carry out. As described by Anthropic:
[In] order to create a PyPI account, Claude needed an email address. And in order to create an email address, it needed a phone number. To get a phone number, after failing to find a free phone number service, it tried—and failed—to obtain funds to pay for a phone number through several different means. It finally backtracked, found a free, non-blocked email provider, used this to register a PyPI account, and then used this account to upload malware to PyPI.
The third intrusion was conducted by the internal model, which stopped operating when it realized that the systems it was accessing were no longer part of the capture-the-flag challenge, but not before using exposed credentials and SQL injection flaws to compromise a company’s internet-facing app.
Anthropic concluded this was primarily a harness and operational failure rather than a case of models pursuing their own goals or deliberately deceiving evaluators.
The company said the incident underscores the need for stricter internet-isolation verification and containment controls in third-party testing environments, and it’s encouraging other AI labs to conduct similar reviews of their own cybersecurity evaluations.
Related: Microsoft Unveils MAI-Cyber-1-Flash, Its First Cybersecurity AI Model
Related: Anthropic’s Mythos Model Found Vulnerabilities in Classified US Government Systems
