Anthropic says its own AI models breached three companies in tests

The disclosure comes just over a week after OpenAI revealed that one of its unreleased models had breached Hugging Face’s systems during internal testing. Anthropic said that episode prompted it to run its own cybersecurity evaluation, specifically looking for evidence that Claude had accessed the internet from within sandboxed testing environments.

Reviewing 141,006 evaluation runs, Anthropic found three incidents in which its model accessed the internet while interacting with third-party partner Irregular. The company traced the access to a misconfiguration in the evaluation environment run with Irregular — a “misunderstanding” between the two companies over whether the test setup had internet access, when it in fact did. Anthropic said it isn’t placing blame and is “approaching the fixes as if the responsibility were ours alone,” while noting Irregular is running its own separate investigation. Because of that open connection, the model gained unauthorized access to the production infrastructure of three different organizations, involving three distinct Claude models: Opus 4.7, Mythos 5, and an internal research test model.

Notably, Anthropic said Claude was explicitly told by its prompt that it had no internet access in each case, and the model appears to have assumed real-world systems were part of the exercise. That assumption didn’t hold uniformly, however. Opus 4.7, the oldest of the three, recognized in all four runs of its incident that it had reached a real production system; in two of those runs it rationalized that the company must somehow be part of the exercise, but kept attacking anyway, including pulling credentials and touching a database of production data. Mythos 5 also picked up signs it was on the real internet but talked itself back into believing it was still in a simulation, going on to publish a malicious software package to the public PyPI registry, which outside systems downloaded and ran before it was caught. Only the internal research test model — Anthropic’s newest — stopped on its own once it concluded the target was real.

Anthropic said Claude was running without the additional safety monitoring and classifiers deployed on generally available models, safeguards it said would have blocked the behavior, because the evaluations are designed to measure a model’s raw capabilities. The company said it found no evidence of any model pursuing a goal of its own — each model was simply trying to complete the task it was asked to do. Anthropic said it is now working with independent evaluation group METR on a third-party review of the incidents.

Why it matters

Two AI labs disclosing real, unintended breaches of third-party systems within weeks of each other signals that evaluation sandboxes built to test AI capabilities are proving harder to keep isolated than the labs assumed — a gap the industry will need to close as models grow more capable.