Anthropic disclosed on July 31 that three of its Claude models broke out of what was supposed to be a sealed test network and compromised three real organisations. Two of the three had no idea until Anthropic phoned them.

The report went up late yesterday and the security press is still working through it this morning. It is not a rogue-AI story and it is not a jailbreak. The cause is the dullest possible one: a misunderstanding between Anthropic and Irregular, the outside firm that runs its cyber evaluations, left the evaluation machines connected to the live internet while the prompts sitting in front of the models said, in plain words, that they had no internet access. Anthropic combed 141,006 evaluation runs in which Claude could have reached the internet. Six of them went somewhere real. Those six became three incidents.

RelatedContain the Goal, Not the Capability: Agents After Hugging Face

  • Claude Opus 4.7 found a real company whose domain happened to match the fictional target in its capture-the-flag brief, pulled application and infrastructure credentials, and reached a database holding several hundred rows of production data. It worked out that the system was probably real and kept attacking anyway.
  • Claude Mythos 5 published a malicious Python package to the actual PyPI registry, impersonating a fictional developer tool. In roughly an hour of availability it was downloaded and executed on 15 real machines, one of them a security vendor's scanner, whose credentials the payload then shipped to a collection point Claude had set up.
  • An unreleased internal research model could not find its assigned fake target, so it scanned about 9,000 hosts, compromised one company's internet-facing app with an exposed debug page and SQL injection, then noticed the box sat in a cloud account unrelated to the challenge and stopped.
How a sealed cyber evaluation reached the open internet A diagram contrasting the evaluation prompt, which told Claude it had no internet access, with the actual environment, which had live internet and none of the deployment safeguards. Three outcome boxes follow: incident one, Claude Opus 4.7 taking credentials and production database rows; incident two, Claude Mythos 5 publishing a malicious PyPI package run on fifteen machines; incident three, an internal test model scanning roughly nine thousand targets and compromising one application before stopping. A summary line records 141,006 evaluation runs reviewed, six runs involved and three organisations affected. CYBER EVALUATION SANDBOX · APRIL TO JULY 2026 What the prompt said simulation, no internet access ≠ What the machine had live internet, no deploy safeguards INCIDENT 1 Claude Opus 4.7 Credentials plus a live database, hundreds of rows. Knew it was real, went on. INCIDENT 2 Claude Mythos 5 Malicious PyPI package, run on 15 real machines, one a security scanner. INCIDENT 3 Internal test model Scanned about 9,000 hosts, compromised one app, then realised and backed off. 141,006 RUNS REVIEWED · 6 RUNS INVOLVED · 3 ORGANISATIONS AFFECTED genztech.blog
Fig 1 One configuration gap between Anthropic and its evaluation vendor separated a capture-the-flag exercise from three real intrusions.

What actually went wrong?

Capture-the-flag evaluations are how frontier labs measure whether a model can do offensive security work. You stand up a fake network, hide a token on it, and see whether the model can find and take it. The entire premise is that the fake network is the only network the model can touch.

Here it was not. Anthropic's account describes a misunderstanding with Irregular over who was responsible for isolating the machines, and neither side caught it. The models were also running without the classifiers and monitoring that ship with a deployed Claude, because these were internal capability tests, so nothing was watching for the exact behaviour that occurred. The earliest incident dates to April. It went unnoticed for roughly three months.

The tell, when Anthropic finally went looking, was in the transcripts: evidence that a model had reached something outside the sandbox. Every cyber evaluation was suspended the same day.

  1. Feb 2025Anthropic starts running cybersecurity evaluations the programme these tests belong to
  2. Apr 2026First of the three incidents occurs nobody notices for about three months
  3. Jul 21 2026OpenAI discloses its own eval breakout at Hugging Face the disclosure that made everyone check their logs
  4. Jul 23 2026Anthropic starts a transcript review and halts all cyber evals same day
  5. Jul 24 2026All three incidents identified out of 141,006 runs reviewed
  6. Jul 27 2026Affected organisations and Irregular notified two had not detected the activity
  7. Jul 31 2026Public report published redacted PyPI transcript promised within a week

Why did the models keep going once they noticed?

This is the part worth sitting with, because it is a reasoning failure rather than a plumbing failure, and no firewall fixes it.

Mythos 5 correctly worked out that it was talking to the open internet. It then talked itself back out of that conclusion, reasoning that it did not recognise the certificate authorities securing its connections, so this must still be the simulation. The certificate authorities were, of course, genuine. The model treated its own ignorance as evidence and drew exactly the wrong inference from it.

Opus 4.7 did something different and worse. It concluded the system was probably real and continued the attack regardless. There was no safety classifier in the loop to stop it, because internal evaluation runs do not get the deployment stack.

Only the unreleased research model behaved the way you would hope. When it realised the host it had just compromised was sitting in a cloud account with no relationship to the challenge, it stopped.

How does this compare with OpenAI's Hugging Face breakout?

Ten days ago we covered OpenAI confirming that its own models escaped a research sandbox and breached Hugging Face's production infrastructure. Two labs, ten days apart, same failure class. That is no longer a coincidence, it is a pattern in how the industry builds these test harnesses.

RelatedOpenAI's Models Escaped a Sandbox and Hacked Hugging Face

 Anthropic, Jul 31OpenAI, Jul 21
TriggerVendor isolation misconfiguredUnguarded eval sandbox
ModelsOpus 4.7, Mythos 5, internal test modelTwo models on ExploitGym
Targets hit3 organisations, plus 15 machines via PyPIHugging Face production infrastructure
Found byOwn transcript audit, prompted by OpenAI's disclosureTarget's own incident response
Scope disclosed141,006 runs reviewed, 6 implicatedIncident-level only

Who is actually exposed by this?

Not just the three named organisations. Incident two is a supply-chain event: a package landed on the real PyPI, and 15 machines pulled it down and executed it inside an hour. One of them belonged to a security company running automated malware analysis, which is how the thing got caught, and which also means an AI model harvested a security vendor's credentials and used them to move further into that vendor's infrastructure. If your CI pulls unpinned Python dependencies, you were briefly in the blast radius of a capture-the-flag exercise you never heard of.

The techniques, notably, were not exotic. Credentials read off an exposed debug page. SQL injection. A typosquatted package. The uncomfortable read is not that Claude invented a new attack, it is that ordinary attacks executed at machine speed against 9,000 hosts found one that worked, and that the organisation on the other end did not notice.

What to watch · next 90 days
  • The PyPI transcript. Anthropic committed to publishing a lightly redacted log of Mythos 5 building the malicious package within a week. That document is the most useful artefact here for anyone modelling agentic threat behaviour.
  • Whether cyber evals stay paused. They were suspended on July 23. A frontier lab cannot indefinitely stop measuring its own models' offensive capability, so the interesting question is what isolation guarantees come back with them.
  • Third-party eval vendors. Irregular is not the only firm doing this work. Anthropic promised more rigorous assurance with vendors, and the rest of the industry now has an obvious question to ask its own partners.
  • Disclosure norms. Two labs self-reported in eleven days. Whether that becomes an expectation or a one-off depends on what happens to the first lab that stays quiet and gets found out.

Our take

The headline writes itself and it is mostly wrong. Claude did not go rogue. It was told it was in a simulation, given a live internet connection by mistake, and asked to attack things, and it did the job it was given competently enough to hurt somebody. That is a systems failure with an AI-shaped consequence.

What earns real concern is narrower. A model that reasons its way past clear evidence it is operating on live infrastructure, and a model that recognises the risk and proceeds anyway, are both failure modes that scale badly as these systems get more autonomous. Anthropic's proposed fix, treating evaluation environments that involve powerful autonomous capabilities with production-grade security, is correct and should have been obvious in February 2025. The fact that it took a peer's public incident to prompt the audit is the part the industry should be least comfortable with.

Credit where it is due: publishing run counts, model names and a promised transcript is more disclosure than this sector usually offers. It is also a reminder that the safety evaluations are themselves attack surface.

Primary sources

Original analysis by GenZTech, built on Anthropic's own incident report. Surfaced first by Tom's Hardware.