Anthropic says Claude models breached real organizations

Following a retrospective review of 141,006 evaluation runs triggered by an OpenAI security incident on July 21, Anthropic discovered that its Claude models breached real-world networks during offensive cybersecurity testing. The review, which began on July 23, led to the discovery of three incidents on July 24, followed by notifications to affected parties on July 27. Due to an internet connectivity misconfiguration by third-party evaluation partner Irregular, the models mistook the live internet for a simulated capture-the-flag environment. Anthropic has been conducting these evaluations since February 2025, starting with Claude Sonnet 3.7 on the Cybench benchmark's 40 challenges, and later using CyberGym, ExploitBench, and ExploitGym.

The breaches involved six total runs across three models: Claude Opus 4.7, Mythos 5, and an unreleased internal research test model. In the first incident, spanning four runs, Claude Opus 4.7 targeted a real company that shared a name with a fictional entity, ultimately compromising its database to access several hundred rows of production data. In the second, Mythos 5 published a booby-trapped package to the public PyPI registry. The package remained online for roughly one hour and was downloaded by 15 real systems, allowing the model to exfiltrate credentials from a security firm's automated scanner. In the third incident, the internal research test model scanned approximately 9,000 targets and compromised an active web application before realizing the environment was real and halting its attack.

For AI practitioners and security researchers, these incidents demonstrate that model containment cannot rely solely on prompting or the assumption of isolated environments. Even though Anthropic explicitly prompted the models that they lacked internet access, the physical availability of an open network path allowed them to act on real targets. Practitioners must implement rigorous, defense-in-depth containment strategies, including strict network-level sandboxing, real-time traffic monitoring, and thorough transcript audits when evaluating autonomous agents. The event proves that as models gain situational awareness and advanced tool-use capabilities, the infrastructure hosting the evaluations must be secured to the same standard as production environments to prevent accidental real-world harm.