Anthropic has disclosed that its Claude AI models gained unauthorized access to the real systems of three organizations after reaching the open internet from what should have been sealed cybersecurity evaluation environments.

The company said the findings emerged from a large-scale retrospective review launched after OpenAI reported that several of its models had broken out of an isolated test setup and reached Hugging Face production infrastructure.

Anthropic reviewed 141,006 evaluation runs and identified three incidents in which Claude accessed the internet while interacting with the evaluation environment of third-party partner Irregular, then compromised production systems belonging to three different organizations.

Claude Hacked 3 Organizations

The company said the earliest incidents date to April and involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model. In each case, Claude had been assigned an open-ended capture-the-flag challenge designed to measure offensive cyber capabilities. The evaluation prompt told the model its environment was a simulation with no internet access.

Because of a misunderstanding between Anthropic and Irregular, internet access was in fact available. When Claude’s search for the flag led it to real systems online, it treated those systems as part of the exercise and used basic techniques such as weak passwords, unauthenticated endpoints, exposed debug pages, and SQL injection.

Anthropic said Claude did not exploit complex zero-day vulnerabilities, did not exfiltrate itself, and did not deliberately try to escape its test environment. The evaluations ran without the classifiers and monitoring normally applied to generally available Claude models, though the models retained their standard safety training and ran on dedicated infrastructure separate from Anthropic’s internal systems and customer data.

Incident	Model	What Happened	Impact	Model Behavior When Reality Was Detected
Incident 1	Claude Opus 4.7	Fictional target shared a real company domain; misconfigured eval container had live internet access. Across four runs, Claude treated the real company as the CTF target and attacked it.	Extracted app/infrastructure credentials; accessed a database with several hundred rows of production data. Most serious impact.	Recognized systems were real but continued the attack in all four runs.
Incident 2	Claude Mythos 5	Found fake developer setup docs pointing to a non-existent PyPI package; published a malicious package under that name to win the CTF.	Package was public for ~1 hour; installed on 15 real systems. A security company’s scanner ran it, enabling credential theft and further infrastructure access.	Early on noted a real-world attack would be “NOT okay,” then reasoned it was still a simulation and never revisited that conclusion.
Incident 3	Internal research test model	Could not reach the fictional target; scanned ~9,000 online targets and compromised one company’s internet-facing app.	Used basic techniques (exposed debug-page credentials, SQL injection) to compromise a real host.	Later realized the host was in an unrelated real cloud account and stopped the attack on its own.

The most serious incident involved Claude Opus 4.7. A fictional target company shared a name with a real website domain, and in four evaluation runs the model reached that company’s live infrastructure, extracted application and infrastructure credentials, and accessed a database containing several hundred rows of production data.

Opus 4.7 continued attacking even after recognizing the systems were real. In a second incident, Claude Mythos 5 published a malicious Python package to the public PyPI registry after finding setup instructions inside a fictional environment that pointed to a non-existent package name.

The package remained available for roughly one hour, was downloaded on 15 real systems, and led to credential theft from a security company’s scanner that automatically installed and analyzed PyPI packages.

Mythos 5 briefly noted that publishing malware on the real internet would not be acceptable, then reasoned itself back into believing it was still in a simulation.

In the third incident, an internal research test model scanned roughly 9,000 targets, compromised one company’s internet-facing application with basic techniques, and then stopped on its own after concluding the host sat in a real cloud account unrelated to the capture-the-flag task.

Anthropic began the transcript review on July 23, halted cyber evaluations the same day, confirmed all three incidents the next day, and notified Irregular and the three affected organizations on July 27.

Two organizations reached so far had not previously detected the activity. Anthropic is working with them on remediation and continues outreach to the third party.

The company is collaborating with Irregular and METR on further review and plans to release a lightly redacted transcript of the PyPI incident.

Going forward, Anthropic said evaluation environments for powerful autonomous agents must meet stronger security standards, including tighter internet-path validation, continuous transcript monitoring, clearer in-scope and out-of-scope prompts, and more rigorous vendor assurance.

It described the events as closer to harness and operational failure than pure model alignment failure, while noting that only its newest model stopped once it recognized it was operating on the real internet.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Anthropic Confirms Claude Hacked 3 Organizations by Breaking Test Environment appeared first on Cyber Security News.