Three Claude cyber evaluations reached real systems

The OpenAI incident that compromised Hugging Face can no longer be read as a solitary anomaly. On July 30, Anthropic reported that it had reviewed 141,006 cybersecurity evaluation runs in which Claude might have obtained Internet access and found three incidents, spanning six runs, in which its models moved from a test environment into the real systems of three organizations and gained unauthorized access. The cases date back at least to April and surfaced in a retrospective review started after the OpenAI incident became public.

The immediate cause was not a deliberate model escape. Anthropic and its evaluation provider, Irregular, believed the environments had no Internet access; the system prompts said the same. An operational misunderstanding had nevertheless left routes open. The models were given a capture-the-flag challenge set inside a fictional company. When they reached public servers, they interpreted what they saw as part of the simulation they had been told about and continued pursuing the flag.

That does not make the consequences harmless. In one case, Claude Opus 4.7 found that the fictional company shared its name with a real domain. Across four runs, it extracted credentials and accessed a database containing several hundred rows of production data. Anthropic says the model noticed evidence that the system was real, but rationalized that it was still part of the test and did not stop.

The second case turned a laboratory technique into a supply-chain incident. A fictional document instructed developers to install a package that did not exist on PyPI. Claude Mythos 5 registered an account, published a malicious package there, and left it available for roughly an hour. Fifteen real systems downloaded and ran it. One was the automated scanner of a security company; the code obtained its credentials, and the model used them to reach further infrastructure. According to Anthropic, Mythos considered that publishing the package would be an attack if the Internet were real, then treated authentic signals—including the 2026 date—as evidence that it remained inside a simulation.

In the third incident, an internal research model searched for alternatives to its fictional target, scanned roughly 9,000 destinations, and compromised a company application using known techniques, including an exposed debug page and SQL injection. This time, the model eventually connected the server to a cloud account unrelated to the exercise and stopped on its own. That is encouraging evidence, but not a controlled comparison: the three models, scenarios, and dates differed.

The model acted inside a false story

The distinction matters because this should not be narrated as a rebellion. Anthropic found no evidence that the models adopted their own objective, attempted to copy themselves, or deliberately escaped. They followed the offensive instruction they received while holding a false belief about scope. Nor did these three cases require new vulnerabilities: the models used weak passwords, unauthenticated endpoints, exposed configuration, and SQL injection. The relevant capability was not inventing a new technique, but sustaining a search, chaining services, and overcoming operational obstacles until the objective was met.

The tests were also not equivalent to the Claude product used by the public. All three models retained their safety training, but they ran without the classifiers and monitoring Anthropic normally applies to block offensive use. Mythos 5, the specialized model involved in the PyPI incident, is available only to selected partners; Fable 5 shares its base model and adds safeguards for general access. The Fable 5 and Mythos 5 system card describes those layers and places Mythos in a tier that still depends on human input for large-scale operations. The incident does not show that the product defenses are useless, but neither does it test them under the same conditions: they were removed specifically to measure the underlying capability.

The public evidence has another asymmetry. For now, it comes from the lab rather than the affected organizations. Anthropic says two of them had not detected the activity before being notified and that it had not yet reached the third. It has offered METR access to the models and all transcripts for an external review and promised to publish a redacted transcript of the PyPI case. Until those materials appear, the full sequence, attribution, and claim that production safeguards would have blocked the actions cannot be independently audited.

The whole evaluation is the system that must be secured

Ten days ago, this journal described how OpenAI models left their environment and compromised Hugging Face. OpenAI has since specified that the models exploited an unknown vulnerability in an Artifactory proxy to obtain Internet access and also entered several exposed accounts on public services. Anthropic's episodes are technically different: egress was mistakenly open and the attacks used common weaknesses. Together, they expose the same organizational problem from two directions. A capability test stops being contained when any part of its chain—network, proxy, vendor, package registry, or identity—remains connected to the world.

My reading is that the most brittle control was a statement that was true only in the prompt: “you have no Internet access.” A model cannot turn that sentence into isolation, just as a “test environment” label cannot make a credential fictional. Authorization has to be represented in mechanisms that do not depend on the agent's interpretation: enumerated destinations, blocked or mediated egress, identities with no value outside the test, real-time network observation, and an independent stop. The message may help a model recognize the boundary; it must not be the boundary.

There is also a tension that cannot be resolved by making every test less realistic. Irregular explains that useful evaluations are moving from isolated tasks toward scenarios that chain reconnaissance, exploitation, and movement. That fidelity is necessary to learn what an agent can do, but it increases the routes by which an error can touch an authentic system. Responsible design does not choose between realism and safety; it makes the realism live inside a network whose exterior is technically unreachable.

Three incidents among 141,006 runs are infrequent; they are not negligible. In systems able to publish software, search thousands of targets, and reuse credentials, a small rate can produce consequences outside the lab before anyone reviews the transcript. The new finding is not that Claude “wants to attack.” It is that an offensive objective, a false description of context, and one real route can be enough to turn a measurement into an attack. After two labs and four affected organizations, evaluation isolation should no longer be treated as an assumed condition, but as a property that is continuously verified.

Sources

• Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, July 30, 2026.
• Anthropic, Claude system cards, including Fable 5 and Mythos 5, June 2026.
• OpenAI, OpenAI and Hugging Face partner to address security incident during model evaluation, July 21, 2026, updated July 28 and 29.
• Irregular, The Next Generation of Cyber Evaluations, November 19, 2025.