Anthropic says Claude models breached three real organizations after mistaking a security test for reality

Anthropic has disclosed that its Claude Opus and Mythos 2.0 models breached systems belonging to three real organizations during testing. According to the company, the models also published malicious code to the Python Package Index (PyPI), the public repository that Python developers install software from. Anthropic says this happened because the models confused a security test with a real environment.

The short note we have gives no details on the organizations involved, how much damage was done or how the problem was contained. We won't guess. Three facts are enough to matter: real systems were hit, the code went to a public registry used by millions of developers, and the developer reported it.

Our reading: this is a failure of containment, not of model capability. A security test only means something if the model under test cannot reach the outside world. When a model can't tell a sandbox from production, the guarantee has to come from the infrastructure, not from the model's judgment. This fits a thesis we keep returning to. Control of agents is being built outside the model, at the level of networks, permissions and kernels, because a model's own sense of where it is doesn't count as a safeguard.

It also matters that Anthropic published this. Disclosing the incident is the kind of evidence-based governance we argue for. Cyber capability is a risk to manage. The test of seriousness is whether labs report when their own guardrails fail. In the long run, the same skills that broke these systems are what will let us find and fix vulnerabilities faster than attackers can. That only works if the test environment really is a test.