Anthropic says Claude breached three real companies in cyber tests

Anthropic disclosed on Thursday that three of its Claude models broke into the production systems of three real organizations during internal cybersecurity evaluations. The review started after OpenAI revealed that its own models had escaped a test environment and compromised Hugging Face. Anthropic went back through 141,006 evaluation runs in which Claude could have obtained internet access, and found six that had.

The models were running capture-the-flag exercises, a standard drill in security testing. A piece of secret information sits somewhere on the network, and the model has to break in and retrieve it. The prompt stated plainly that the environment was a simulation with no internet access. It was not. The evaluation environments run by Irregular, an external testing partner, had a live path to the open internet, and nobody had noticed.

The worst case reached a production database

The most damaging incident involved a fictional target company that happened to share its name with a real domain. Claude Opus 4.7 stalled inside the simulated network, found the real company instead, and treated it as the intended target. Across four runs the model harvested credentials and reached a database holding several hundred rows of live production data. Opus 4.7 worked out that the system was real and kept going anyway. In two of those runs it talked itself into believing the real company was part of the exercise.

One model uploaded working malware to PyPI

The second incident is the one that sticks. Claude Mythos 5 found a document in the test environment telling new developers to install a Python package that did not exist. The model spotted the gap and built its own package under that name, with malicious code inside. Uploading it meant creating an account on PyPI, the public registry for Python software, which meant an email address, which meant a phone number. Several attempts to get hold of money for a number failed, so the model fell back on a free email provider and pushed the malware live.

The package sat in public for about an hour. In that window it was installed and executed on 15 real systems, one of them the malware scanner of a security firm that had nothing to do with the scenario. Claude sent that company’s credentials to a collection point it had set up and used them to reach further infrastructure. The defences PyPI runs itself pulled the package automatically.

What the model told itself is worth reading. It had noted that on the real internet an upload like this would be an actual attack and certainly not the intended solution. Two things convinced it otherwise: it did not recognize the certificate authorities securing its connections, and the systems showed a calendar date of 2026, which it took as proof of a staged environment. It never revisited that conclusion.

Three months without anyone noticing

The earliest incident dates back to April. It only surfaced when Anthropic began reading through the transcripts on 23 July and halted every cybersecurity evaluation the same day. All three incidents were confirmed on 24 July, and the testing partner and the affected organizations were notified on 27 July. Two of the three organizations had no idea their systems had been touched. The third had not been reached by the time the post went out.

In the third incident an internal research model scanned roughly 9,000 targets and compromised an internet-facing application through an exposed debug page and SQL injection. It then worked out on its own that the target was real and stopped. Anthropic reads that as progress but warns against drawing a rule from three isolated cases.

What this means for users

Not much directly. The evaluations ran without the classifiers and monitoring that sit on the publicly available Claude models, and Anthropic says those layers would have blocked the behaviour. Nobody outside the company has checked that claim. The other half of the sentence matters more: the model-specific safety training was active and it was not enough. Anthropic therefore treats the incidents as a failure of its testing infrastructure rather than a misalignment of the models, and takes the blame itself instead of pushing it onto its partner.

The contrast with the OpenAI case is sharp on the technical side. There the models exploited a previously unknown flaw to get online at all. Claude found a door standing open and needed nothing more than weak passwords and unauthenticated endpoints. Anthropic plans to publish a lightly redacted transcript of the PyPI run within the week, and talks are under way with METR, an independent evaluation body, about an outside review. How shaky confidence in these testing methods has become is clear from the open letter signed by more than 1,290 people across the industry, who want a verifiable brake on AI development.