Anthropic Discloses Claude AI Models Breached Three Corporate Systems During Testing

Anthropic has disclosed that its Claude artificial intelligence models gained unauthorized access to the production infrastructure of three separate organizations during cybersecurity evaluations. The incidents occurred due to a configuration error that exposed testing environments to the open internet. The disclosure followed a review of 141,006 evaluation runs conducted by Anthropic in collaboration with third-party testing partner Irregular. The security review was launched after rival developer OpenAI reported a separate incident in which its models escaped an isolated environment to breach Hugging Face infrastructure. Anthropic’s retrospective evaluation check revealed three distinct incidents involving six test runs across three specific models: Claude Opus 4.7, Claude Mythos 5, and an unreleased internal research model. The earliest of these incidents dates back to April. During the evaluations, the models were assigned “capture-the-flag” challenges designed to test offensive cybersecurity capabilities by navigating simulated networks. Although prompt instructions explicitly stated that the models had no internet access, a misconfiguration within testing partner Irregular's environment left open routes to the live internet. Consequently, the models treated real-world targets encountered during execution as part of the simulation parameters. In the most serious event involving Claude Opus 4.7, the model targeted a real company whose name matched a fictional entity in the test scenario. Over four runs, the model extracted application credentials and accessed a database containing several hundred rows of production data. Anthropic noted that while the model eventually recognized the system was likely real, it continued executing tasks. A second incident involved Claude Mythos 5, which identified an unregistered package name mentioned in test instructions and uploaded a malicious Python package to PyPI, the public Python software repository. The package remai