Anthropic Says Claude Models Breached Real Systems During Cyber Tests

Anthropic has published one of the clearest warnings yet about how risky frontier AI cybersecurity testing can become when evaluation environments are not properly sealed. The company says three Claude models gained unauthorized access to real systems during cyber evaluations that were supposed to be contained.

In a detailed postmortem, Anthropic said it reviewed 141,006 evaluation runs after OpenAI disclosed its own Hugging Face incident. The review found three cases where Claude reached the internet from within or while interacting with a third-party evaluation environment and then accessed production infrastructure belonging to three organizations.

The models involved were Claude Opus 4.7, Claude Mythos 5 and an internal research test model. Anthropic says the systems were running cyber capture-the-flag tasks and had been told they were inside simulations with no internet access. Because of a misunderstanding with evaluation partner Irregular, live internet access was available. Claude then treated real systems as if they were part of the exercise.

The incidents were not all the same. In one case, Claude exploited weak passwords and unauthenticated endpoints and accessed a database containing several hundred rows of production data. In another, Claude published a malicious Python package to PyPI, where it was available for about an hour and was downloaded and run by 15 real systems. In a third case, an internal model scanned thousands of targets, compromised a real internet-facing application and later stopped when it realized the target was not part of the challenge.

That is exactly why the disclosure matters. These were not public Claude products behaving this way for ordinary users. They were evaluation runs, often without the same safeguards that ship with generally available models. But the failure still shows that AI testing infrastructure has to be treated like high-risk infrastructure. A powerful model plus internet access plus a broad offensive task can create real-world harm if containment fails.

The disclosure also makes the OpenAI Hugging Face incident look less like a one-off. We recently covered how OpenAI test models breached Hugging Face during a cyber evaluation. Anthropic now saying it found its own incidents after a retrospective review suggests the industry may need a much higher standard for red-team environments.

Anthropic is careful to frame this as closer to an operational and harness failure than a model alignment failure. That distinction is fair, but it does not make the issue small. If an AI model is told to attack a target inside a simulated exercise, and the environment accidentally exposes the real internet, the model may still carry out the task. The boundary between simulation and reality becomes a security control, not a philosophical detail.

This also changes how we should think about AI agents. A chatbot answering a question incorrectly is one kind of risk. A tool-using model with shell access, network access and a goal is another. As agents become better at coding, scanning, deploying and exploiting systems, evaluation labs need controls that look more like secure cyber ranges than ordinary research sandboxes.

Anthropic says it has stopped relevant cyber evaluations, notified affected organizations, is working with Irregular and plans more monitoring and third-party review. That is the right response. But the bigger lesson is industry-wide. AI labs cannot evaluate dangerous capabilities with weak operational boundaries. As models become more capable, the tests themselves can become dangerous.