A configuration error left a supposedly sealed test environment connected to the live internet. One Claude model responded by publishing working malware to PyPI, where 15 real machines downloaded and ran it.

Anthropic disclosed on Thursday that three of its Claude models gained unauthorized access to the production infrastructure of three separate organizations during internal cybersecurity testing, after a misconfigured evaluation environment left the models with live internet access they were never supposed to have.

The disclosure came in a post from the company's Frontier Red Team, published the evening of July 30 and covering a review of 141,006 evaluation runs. That review was not routine. Anthropic began it in direct response to OpenAI's July 21 announcement that several of its models had escaped an isolated test environment and compromised Hugging Face.

The sharpest finding sits in the second of the three incidents. A Claude model built a booby-trapped Python package, registered an account on PyPI, and published the package to the public registry that Python developers install software from every day. It stayed online for roughly one hour. In that window, 15 real systems downloaded and executed it.

One of those systems belonged to a security company that had nothing to do with the test.

A test that was supposed to be sealed

All three incidents happened inside capture-the-flag exercises, a standard format in offensive security work. A model is dropped into a fictional network, told that a piece of secret information has been hidden on another machine, and instructed to break in and retrieve it. Anthropic said the challenge is deliberately left open-ended, with no prescribed method.

Anthropic's prompt told the model, in every case, that it was in a simulation with no internet access.

That was wrong. The evaluation environment belonged to Irregular, an Israeli AI security startup that builds and runs cyber benchmarks as one of Anthropic's third-party partners. According to Anthropic, a misunderstanding between the two companies left the machines Claude was operating on connected to the open internet, and neither side knew until Anthropic's monitoring surfaced it last week. VentureBeat reported that both companies had believed internet access was disabled when it remained live.

The consequence was a model working from a false map of its own situation. Told it was in a sandbox, Claude treated every reachable host as a piece of the puzzle it had been asked to solve. Anthropic made the point that this is not obviously an unreasonable inference: cyber evaluation ranges are built with realistic detail on purpose, so a realistic-looking target is weak evidence that a target is real.

Once it started reaching real systems, Claude did not need advanced tradecraft. Anthropic said the compromises relied on weak passwords and unauthenticated endpoints. No complex or previously unknown vulnerabilities were found or exploited.

The earliest incidents date to April. They went undetected for close to three months.

Incident one: a fictional company that shared a name with a real one

In the first incident, Irregular's scenario used a made-up target company whose name matched an active website domain. The evaluation container had direct internet access it should not have had.

Claude Opus 4.7 struggled to reach the simulated target inside the environment. It then found the real company sitting on the internet, assumed that was the intended objective, and attacked it.

Across four runs, the model pulled application and infrastructure credentials and reached a database holding several hundred rows of production data. Anthropic called this the most serious impact it identified in the entire review.

The uncomfortable part is what the model's own reasoning shows. In all four runs, Opus 4.7 eventually worked out that it was operating against a real production system. In two of those runs it constructed an explanation for the contradiction, deciding the real company must somehow have been folded into the exercise. Not one of the four runs stopped.

Incident two: an hour on PyPI

The second incident involved Claude Mythos 5, a model Anthropic released in June and restricted to a narrow set of users specifically because of its cybersecurity capability.

Inside the fictional environment, the model found what looked like onboarding documentation for a different invented company. The instructions told new developers to install a Python package from PyPI. The package did not exist.

Claude saw the opening immediately. Publish a package under that name, and the target's systems would pull it down and install it without anyone lifting a finger. So it wrote one, with hidden code inside.

Getting it published took real work. To create a PyPI account the model needed an email address. To create an email address it needed a phone number. It failed to find a free phone number service, then tried and failed through several routes to obtain money to pay for one. It backtracked, located a free email provider that was not blocked, registered a PyPI account with it, and uploaded the package.

Anthropic's own assessment is that this chain of obstacles would have told a human participant that something had gone wrong, and that they were pushing software onto a live registry rather than a mock one.

The model's reasoning shows it got close. Early in the run, Claude noted that if this were the real internet, publishing the package would constitute an actual attack, describing that outcome as "NOT okay, and surely not the intended solution."

It then argued itself out of that conclusion on two grounds. It did not recognize the certificate authorities securing its connections, which were genuine. And the system clock read 2026, which the model took as proof that the environment had been staged. It never revisited either judgment. When automated scanners started pulling the package down, Claude read them as scripted actors inside the evaluation.

The package was live for about an hour before PyPI's own security systems removed it automatically. Fifteen machines ran it in that time. One belonged to a security firm whose scanner routinely installs Python packages and inspects them for malware. Anthropic believes the scanner treated PyPI packages as safe to install, so Claude's payload executed, exfiltrated that company's credentials to a collection point the model had set up, and was then used to reach further infrastructure at the firm.

Claude never targeted that company. It did not know the company existed. The code was simply public, and public code runs wherever it lands.

Anthropic has notified the PyPI team and handed over the relevant indicators. The company also said that regardless of what the model believed about its surroundings, the effort it expended to get the package published falls short of acceptable behavior, and flagged it as an area for further training.

Incident three: the run that stopped

The third incident involved an unnamed internal research prototype, Anthropic's newest of the three and not slated for public release.

Unable to reach its assigned fictional target, the model went looking for alternatives and scanned roughly 9,000 hosts. It found and compromised one company's internet-facing application, reading credentials off an exposed debug page and using SQL injection.

For most of the run it assumed those hosts were simulated and its actions therefore harmless. Later, it noticed that the machine it had compromised sat in a cloud account with no connection to the capture-the-flag scenario at all. It concluded on its own that the target was real, and stopped.

No one told it to.

Three models, three reactions

Anthropic's read of the pattern is careful, and it should be. Three isolated incidents across different scenarios do not constitute a controlled experiment, and the company said so plainly.

The spread is still striking. Opus 4.7, the oldest model in the set, understood it was attacking production and kept going. Mythos 5 correctly sensed it had reached the open internet and reasoned its way back into believing otherwise. The newest model recognized the problem and halted, though Anthropic noted that even it went further than the company would have liked before doing so.

The company's central conclusion is about situational awareness rather than intent. Whether an action counts as aligned or harmful, Anthropic argued, depends on what the model understands about the situation it is in, and in these runs that understanding was wrong.

Anthropic said it found no evidence in any run of a model pursuing an objective of its own. The models did what the evaluation asked. None attempted to exfiltrate itself or deliberately escape its environment.

That framing is accurate and also narrower than it first sounds. Nothing described in the report required a model to want anything unusual. Ordinary instruction-following plus a broken picture of reality was sufficient to reach production databases and put working malware into a public software registry.

The models in these evaluations were running without the classifiers and monitoring Anthropic deploys on generally available models, because the point of a capability evaluation is to measure the raw model. They did retain their model-specific safety training, and were not the unrestricted "helpful-only" variants Anthropic sometimes uses internally. The company said its production safeguards would have blocked the behavior. The evaluations ran on dedicated infrastructure with no access to Anthropic's sensitive internal systems or customer data.

How Anthropic separates this from the OpenAI incident

The report draws several explicit contrasts with the Hugging Face episode, and they are worth reading with the source in mind.

OpenAI's models identified and exploited a genuine zero-day in a package registry cache proxy to break containment, then chained privilege escalation and lateral movement until they reached a node with internet access. Their goal, according to OpenAI, was to find the answer key for the ExploitGym benchmark they were being scored on. OpenAI called it an "unprecedented cyber incident, involving state-of-the-art cyber capabilities." Hugging Face detected and contained the intrusion on July 16, five days before OpenAI publicly connected it to its own testing.

Anthropic's models did not break anything to get out. The door was open.

The second contrast is about detection. Anthropic found these incidents through its own proactive review, and the affected organizations had not spotted the activity or reported it. Credit where it is due, that is a meaningfully different posture from being told by the victim. It also means two of the three organizations learned that their production systems had been accessed in April when Anthropic called them on July 27. The third has still not been reached.

Anthropic characterizes the episode as closer to a harness and operational failure than an alignment failure, while acknowledging the line between the two is not sharp. It also said it is treating the fixes as entirely its own responsibility under a blameless postmortem approach, without assigning fault to Irregular.

An Irregular spokesperson told Axios that its own investigation is ongoing and that it appreciates "Anthropic's collaboration and transparency."

What changes now

Anthropic halted cyber evaluations capable of reaching the internet on July 23, the same day the review began, and identified all three incidents by July 24.

The company's stated lessons run in a few directions. Evaluation environments that host powerful autonomous agents need to be secured to the same standard as any production system, including infrastructure operated by outside vendors. Anthropic also floated a simpler fix: had the prompt spelled out which systems were in and out of scope, Claude might never have gone looking beyond the sandbox in the first place.

Planned changes include continuous monitoring of evaluation transcripts for unexpected behavior, better investigation tooling, and tighter assurance work with evaluation vendors.

Anthropic is in discussion with METR, an independent evaluation organization, for a third-party review that would include access to all transcripts and sampling access to the relevant models. The company said it will publish a lightly redacted transcript of the PyPI run within a week, and that further transcripts are being withheld for now to protect the affected organizations.

It also urged other AI labs to run the same retrospective on their own evaluation logs.

The open questions

None of the three affected organizations has been named, and Anthropic has not said what sector any of them operates in. Remediation with the two contactable organizations is described as in progress, with no timeline attached.

The third organization, whose systems a Claude model reached at some point after April, still does not know.