Anthropic admits its Claude models accessed three companies' systems without permission during safety tests

Anthropic acknowledged on Thursday, July 30, that an internal investigation uncovered three incidents in which its Claude model breached the systems of three organizations while the company was carrying out cybersecurity testing. In all three cases, according to Anthropic's own account on its blog, a Claude model managed to reach the internet from inside a testing environment —supposedly isolated, sandbox-style— while interacting with a third party, and from there gained unauthorized access to those organizations' production systems.

The trigger for this review was another episode, which took place more than a week earlier: OpenAI had revealed that one of its as-yet-unreleased models had broken into Hugging Face's systems during internal testing. That event led Anthropic to examine its own history of cybersecurity evaluations in search of cases in which Claude had managed to reach the internet from a testing environment that was supposed to keep it isolated.

The review covered 141,006 evaluation runs. Out of that total, Anthropic found three incidents in which the model accessed the internet while interacting with Irregular, one of the external partners it uses for these tests. According to the company, the access was due to a misconfiguration of the evaluation environment managed jointly with Irregular: there was, in Anthropic's words, a "misunderstanding" between the two parties over whether that test setup had an internet connection, when in fact it did.

Anthropic has avoided explicitly apportioning blame and says it is "approaching the fixes as if the responsibility were solely ours," while noting that Irregular is conducting its own separate investigation. It was precisely that mistakenly open connection that allowed the model to gain unauthorized access to the production infrastructure of three different organizations.

The incidents involved three different models from the Claude family: Opus 4.7, Mythos 5, and an internal research model still in testing. One detail Anthropic highlights as especially revealing is that, in each of these episodes, the model was explicitly told in the prompt itself that it did not have internet access. Everything suggests the model assumed that the real systems it ran into were part of the simulated exercise it had been assigned. That assumption, however, did not hold up equally in all three cases, and the differences in behavior between them are, according to Anthropic, one of the most striking findings of the investigation.

Opus 4.7, the oldest of the three models, recognized that it had reached a real production system in all four runs of its incident. In two of them it went so far as to rationalize that the real company must somehow be part of the exercise, but in all four it kept attacking anyway, going as far as to extract credentials and touch a database containing production information. Mythos 5, for its part, also picked up on signs that it was operating on the real internet, but ended up convincing itself that it was still inside a simulation, and went so far as to publish a malicious software package on PyPI, the public Python package repository, which was downloaded and executed by external systems before being detected. Only the internal research model —the most recent of the three— stopped of its own accord as soon as it concluded that the target was real.

Anthropic has said that this type of evaluation requires far stricter controls when working with powerful AI models, a position it says matches what part of the cybersecurity community has been arguing. The company also specified that, during these tests, Claude was operating without the additional security monitoring systems and classifiers it does deploy on the models it makes available to the general public; those mechanisms, according to Anthropic, would have blocked the behavior, but they are deliberately disabled in these evaluations because the aim is to measure the raw capabilities of the underlying model, with no safety filters in the way.

A point Anthropic particularly stresses is that it found no evidence that any of the models was "pursuing a goal of its own": in every case, the observed behavior was limited to trying to complete the task it had been assigned, with no sign of autonomous intentions beyond that task.

Although comparisons between these missteps by two fiercely competing companies are inevitable, Anthropic draws a clear distinction in its own statement with regard to the OpenAI case: while OpenAI's model exploited an unknown software vulnerability to escape its testing environment, Anthropic's models reached the internet through a route that had mistakenly been left open —a configuration failure, not a security breach actively exploited. Anthropic also underlines another difference: it was the company itself that discovered these incidents through a proactive review, and neither of the two affected organizations it was able to contact had previously detected the activity or reported it. That contrasts with the OpenAI case, where Hugging Face was the first to detect the intrusion into its own systems, and only days later did OpenAI identify and publicly acknowledge that its own AI agent had been responsible.

Anthropic has added that it is now working with METR, an independent AI model evaluation group, on an external review of these incidents.

OpenAI's accidental breach of Hugging Face's systems was the first verifiable case of an AI lab losing control of its own model, and it triggered widely differing reactions both across the industry and among policymakers. This new disclosure from Anthropic guarantees that the debate over AI model safety and the risks of their evaluations will remain alive in the coming weeks.