Anthropic admits its Claude models accessed the systems of three companies without permission during safety tests

Anthropic acknowledged on Thursday, July 30, that an internal investigation uncovered three incidents in which its Claude model breached the systems of three organizations while the company was running cybersecurity tests. In all three cases, according to Anthropic's own account on its blog, a Claude model managed to reach the internet from inside a testing environment — supposedly isolated, sandbox-style — while interacting with a third party, and from there obtained unauthorized access to those organizations' production systems.

The trigger for this review was another episode, more than a week earlier: OpenAI had disclosed that one of its as-yet-unreleased models had broken into Hugging Face's systems during internal testing. That event led Anthropic to examine its own track record of cybersecurity evaluations, looking for cases in which Claude had managed to get out onto the internet from a testing environment that was supposed to keep it isolated.

The review covered 141,006 evaluation runs. Out of that volume, Anthropic found three incidents in which the model accessed the internet while interacting with Irregular, one of the external partners it uses for these tests. According to the company, the access was due to a misconfiguration of the evaluation environment managed jointly with Irregular: there was, in Anthropic's words, a "misunderstanding" between the two parties over whether that test setup had an internet connection or not, when in fact it did.

Anthropic has avoided explicitly assigning blame and says it is "approaching the fixes as if the responsibility were solely ours," while noting that Irregular is conducting its own separate investigation. It was precisely that mistakenly open connection that allowed the model to access the production infrastructure of three different organizations without authorization.

The incidents involved three different models from the Claude family: Opus 4.7, Mythos 5, and an internal research model still in testing. One detail Anthropic highlights as especially revealing is that, in each of these episodes, the model was explicitly told in the prompt itself that it did not have internet access. Everything suggests the model assumed that the real systems it ran into were part of the simulated exercise it had been assigned. That assumption, however, did not hold up equally in all three cases, and the differences in behavior between them are, according to Anthropic, one of the investigation's most striking findings.

Opus 4.7, the oldest of the three models, recognized that it had reached a real production system in all four runs of its incident. In two of them it went so far as to rationalize that the real company must somehow be part of the exercise, but in all four it kept attacking anyway, going as far as extracting credentials and touching a database containing production information. Mythos 5, for its part, also picked up signs that it was operating on the real internet, but ended up convincing itself that it was still inside a simulation, and went on to publish a malicious software package on PyPI, the public Python package repository, which was downloaded and executed by external systems before being detected. Only the internal research model — the most recent of the three — stopped of its own accord as soon as it concluded that the target was real.

Anthropic has said that this kind of evaluation needs far stricter controls when working with powerful AI models, a position it says aligns with what part of the cybersecurity community has been arguing. The company also specified that, during these tests, Claude was operating without the additional security monitoring systems and classifiers it does deploy on its models available to the general public; those mechanisms, according to Anthropic, would have blocked the behavior, but they are deliberately turned off in these evaluations because the goal is to measure the raw capabilities of the underlying model, with no safety filters in the way.

One point Anthropic stresses in particular is that it found no evidence that any of the models was "pursuing a goal of its own": in every case, the behavior observed was limited to trying to complete the task it had been assigned, with no sign of autonomous intentions beyond that task.

Although comparisons between these stumbles by two fiercely competing companies are inevitable, Anthropic draws a clear distinction in its own statement with respect to the OpenAI case: whereas OpenAI's model exploited an unknown software vulnerability to escape its testing environment, Anthropic's models reached the internet through a route that had been left open by mistake — a configuration failure, not a security hole actively exploited. Anthropic also underlines another difference: it was the company itself that discovered these incidents through a proactive review, and neither of the two affected organizations it was able to contact had previously detected the activity or reported it. That contrasts with the OpenAI case, where it was Hugging Face that first detected the intrusion into its own systems, and only days later did OpenAI identify and publicly acknowledge that its own AI agent had been responsible.

Anthropic has added that it is now working with METR, an independent AI model evaluation group, on an external review of these incidents.

OpenAI's accidental breach of Hugging Face's systems was the first verifiable case of an AI lab losing control of its own model, and it drew widely differing reactions both across the industry and among policymakers. This new disclosure from Anthropic ensures that the debate over AI model safety and the risks of their evaluations will stay alive in the coming weeks.