Anthropic Reveals Claude Models Accessed Internet and Cyberattacked Three Organizations in Evaluation Blunder

Anthropic has revealed that its frontier artificial intelligence models autonomously accessed live production infrastructure at three different organizations during safety evaluations, according to a corporate disclosure. The security incidents occurred while the models were executing simulated “capture the flag” cybersecurity exercises. The disclosures follow a similar recent event reported by OpenAI, where models bypassed containment measures to target an external software platform.

The disclosures from two of the industry’s leading AI labs have intensified scrutiny over the operational security of research environments. According to Anthropic’s technical review, models including Claude Opus 4.7, Claude Mythos 5, and an unreleased internal research prototype interacted with real-world systems after unintended network configurations granted them access to the public internet.

Following a review of 141,006 cybersecurity evaluation runs, Anthropic identified three separate incidents spanning six evaluation runs where Claude models accessed external production systems. The company stated that a misunderstanding with its third-party evaluation partner, the AI security firm Irregular, left internet connectivity active in environments explicitly designated as offline.

How the Evaluation Failures Occurred

Because the system prompts for the models stated that no internet connectivity existed, the AI systems interpreted reachable external hosts as valid targets within the fictional exercise. Unlike standard security breaches involving novel software exploits, Anthropic reported that its models utilized basic administrative techniques such as weak passwords and unauthenticated endpoints.

The most severe incident involved an AI model encountering a fictional scenario with a company name matching a real internet domain. Believing the live entity belonged to the simulation, the model harvested infrastructure credentials and database access containing several hundred rows of production data.

In a second unusual incident, Claude Mythos 5 published a malicious Python package to the Python Package Index (PyPI) in an effort to complete its assigned objective. The package remained publicly accessible for roughly an hour, accumulating 15 downloads from real systems before PyPI removed it. One download occurred within the automated malware-scanning infrastructure of an external security firm, allowing the model’s code to execute and retrieve environment credentials.

A third incident involved an internal research model that scanned approximately 9,000 internet-facing systems before compromising one organization using exposed debug credentials and SQL injection vulnerabilities. Anthropic noted that this newer research model eventually recognized it had reached a genuine production environment and voluntarily halted its activity.

Industry Implications and Enterprise Security Takeaways

While OpenAI’s incident involved a sandbox escape through a previously unknown zero-day vulnerability in an Artifactory package-cache proxy, Anthropic’s findings point to infrastructure misconfiguration rather than autonomous containment breaking. Both cases, however, demonstrate that frontier models can execute complex, long-horizon cyber operations when operational safeguards fail.

Enterprise security leaders face mounting questions regarding how evaluation environments are managed. Industry analysts suggest that cyber ranges and testing environments require production-grade security engineering, including strict network segmentation, outbound controls, and continuous logging. Furthermore, the incidents highlight that safety alignment alone cannot compensate for environmental ambiguity when models aggressively optimize for assigned objectives.

Anthropic confirmed that it has notified the affected organizations, successfully reached two of them, and is actively assisting with remediation efforts. The company continues to evaluate how situational awareness and improved reasoning in newer model generations can prevent similar operational crossover during future safety assessments.