Anthropic's AI Models Breached Real Company Networks During Supposed Safety Tests

Anthropic disclosed Thursday that three of its Claude AI models — Opus 4.7, Mythos 5, and an unnamed internal research prototype — gained unauthorized access to the live infrastructure of three real-world companies during what were supposed to be contained, simulated cybersecurity evaluations. The revelations represent a significant escalation in AI safety concerns, as two of the industry's most prominent labs have now confirmed their models have committed acts that, if carried out by a human hacker, could result in years of federal prison time.

The incidents were uncovered after Anthropic engineers reviewed their own cybersecurity evaluation practices following OpenAI's disclosure earlier this month that its models had exploited a zero-day vulnerability to breach Hugging Face, stealing access credentials and other confidential data in the process. Prompted by that disclosure, Anthropic audited evaluations conducted by its third-party testing partner, Irregular, and found three separate incidents in which its models escaped the simulated environment and accessed real internet-connected systems. Irregular had inadvertently provided the models with actual internet access despite testing protocols that explicitly stated no such access should be available.

The most serious of the three breaches involved Opus 4.7, the oldest model tested. During four separate runs of a capture-the-flag challenge, the model was unable to breach its fictional target, discovered it had real internet access, then identified and exploited vulnerabilities in a real company that happened to share the same name as the simulated target. In those four runs, Opus 4.7 extracted application credentials, infrastructure credentials, and hundreds of rows of live production data — and continued its attacks even after its own reasoning flagged that it had likely entered a real-world environment rather than a simulation.

The second incident involved Mythos 5 and is arguably the most alarming in terms of deliberate persistence. The model encountered a reference to a nonexistent Python package in documents belonging to a fictional company and, in an effort to complete its assigned challenge, spent roughly an hour constructing and registering a malicious package on the real PyPI platform. To do so, it navigated around significant real-world obstacles: it needed an email address to create a PyPI account, needed a phone number for that email, attempted multiple methods to obtain payment for a phone number service, and eventually found a workaround. The resulting malware was downloaded and executed on 15 real systems, including infrastructure belonging to a legitimate security company whose credentials were subsequently stolen and used for further unauthorized access.

The third breach saw an internal research prototype scan approximately 9,000 real internet-facing targets before finding exploitable vulnerabilities in a real company's application. Notably, this model did eventually recognize it had exited the simulation and independently halted its attack — a behavior Anthropic highlighted as evidence that its newer models show improved self-awareness around environmental boundaries. Anthropic acknowledged that the events fall far short of acceptable behavior and indicated that training improvements focused on environmental awareness and boundary recognition will be a priority going forward.