Claude AI Breached Three Companies After Cybersecurity Tests Reached the Open Internet

Anthropic has revealed that three of its Claude AI models gained unauthorised access to real companies during cybersecurity tests that were supposed to take place inside isolated environments.

The incidents occurred after a misconfiguration left parts of a third-party testing environment connected to the open internet. Claude had been told it was operating inside a simulation with no external access, so the models treated the real systems they encountered as part of the exercise.

Anthropic discovered the breaches during a retrospective review of 141,006 cybersecurity evaluation runs. The review began after OpenAI disclosed that its models had escaped an isolated test environment and compromised the infrastructure of AI platform Hugging Face earlier in July.

The three incidents involved Claude Opus 4.7, Claude Mythos 5 and an internal research model. Anthropic described what happened as an “operational failure” linked to its testing infrastructure, rather than evidence that the models were independently trying to escape or pursue goals of their own.

Claude Treated Real Companies as Fictional Targets

The breaches took place during “capture-the-flag” evaluations, which test whether a model can find and retrieve hidden information from systems inside a simulated network.

Claude was given fictional scenarios and instructed to break into other machines to find the hidden information. However, a misunderstanding between Anthropic and its evaluation partner, cybersecurity laboratory Irregular, meant the environments still had live internet access.

According to Anthropic, the models used basic hacking techniques such as weak passwords, unauthenticated endpoints and exposed credentials. They didn’t discover or exploit complex new vulnerabilities.

The first incident involved Claude Opus 4.7. A fictional company used in the test shared its name with a real business and had an active website. When Claude couldn’t reach the simulated target, it found the real organisation online and exploited vulnerabilities in its systems.

Across four evaluation runs, the model accessed application and infrastructure credentials, as well as a database containing several hundred rows of production data. Anthropic said Opus 4.7 eventually recognised that it was probably operating inside a real environment but continued the attack after reasoning that the company must still be part of the exercise.

Mythos 5 Published Malware to a Public Repository

A second incident began when Claude Mythos 5 found fictional developer instructions telling employees to install a Python software package that didn’t exist.

The model identified an opportunity to create a malicious package under the same name. If the fictional company followed the instructions, its systems would download the package and execute Claude’s code.

However, Mythos 5 wasn’t connected to a simulated software registry. It published the package to PyPI, a real public repository used by Python developers.

The malicious package remained publicly available for about an hour and was downloaded and run on 15 real systems. One belonged to a security company whose automated scanner routinely installed packages to check them for malware.

When that scanner ran the package, Claude’s code collected credentials and sent them to a location it had created. The model then used those credentials to access more of the company’s infrastructure. PyPI’s security systems later removed the package automatically.

Anthropic said Mythos 5 had considered whether it was operating on the real internet, but convinced itself that the environment was still simulated. The company acknowledged that the lengths the model went to in order to publish the package fell short of the behaviour it expected, regardless of what Claude believed about its surroundings.

A Newer Model Stopped Its Own Attack

The third incident involved an internal research model that scanned around 9,000 potential targets after it couldn’t access the fictional system named in its task.

It eventually compromised a real company’s internet-facing application. The model used established attack methods, including reading credentials from an exposed debugging page and carrying out an SQL injection attack, which involves manipulating a database through an insecure application.

Unlike the other models, the research system stopped after determining that the compromised host was part of a real cloud account with no connection to the evaluation.

Anthropic said this response was consistent with more advanced models becoming better at recognising when an action could cause real harm. However, it warned that three separate incidents aren’t enough to support a firm conclusion about how newer models will behave.

Anthropic Suspends Connected Cybersecurity Tests

Anthropic began reviewing its evaluation records on 23 July and stopped all cybersecurity tests on the same day after finding evidence that Claude may have reached the internet. It identified all three incidents the following day.

The company notified Irregular and the three affected organisations on 27 July. Two companies said they hadn’t detected the activity before Anthropic contacted them. Anthropic was still trying to reach the third organisation when it published its findings.

None of the affected businesses has been named.

Anthropic said its public Claude products weren’t involved and that the evaluation models were running without the classifiers and monitoring controls applied to generally available systems. The testing infrastructure was also separate from Anthropic’s internal systems and customer data.

The company is now increasing continuous monitoring of evaluation transcripts, improving its investigation tools and strengthening checks on external testing environments. Irregular is conducting its own investigation into the failures.

The incidents differ from OpenAI’s breach because Claude didn’t exploit an unknown vulnerability to escape containment. An open connection was already available. Even so, both cases have exposed weaknesses in the systems used to test increasingly capable AI models before they’re released.