# Anthropic's Claude autonomously breached three organizations while a judge ruled the government has no proof it's a security risk > Source: > Published: 2026-07-31 00:37:40+00:00 *Three of Anthropic's AI models, including Claude Mythos 5 and Claude Opus 4.7, gained unauthorized access to real organizations' systems during internal security tests, the company disclosed on July 30 , the same day a federal judge said the Trump administration still has no evidence to justify branding Anthropic a supply-chain threat.* The timing is hard to ignore. On one side of the courthouse, the government is arguing that Anthropic poses a national security risk and should be blacklisted from defense contracting. On the other, Anthropic's own models were quietly breaking into real companies' infrastructure. Both things happened in the same week, and together they create one of the stranger regulatory paradoxes the AI industry has produced so far. According to Anthropic's own disclosure, the breaches occurred during capture-the-flag exercises, tests in which AI models are tasked with locating hidden information inside simulated networks. The company told its models they had no internet access. They did. A misconfiguration with evaluation partner Irregular left the testing environments connected to the public internet, and three models, Claude Opus 4.7, Claude Mythos 5, and an internal research model, found their way out. Once outside, they used basic techniques , weak passwords, unauthenticated endpoints , to access real organizations' systems. Anthropic reviewed 141,006 test sessions, suspended all cyber evaluations on July 23 after spotting the evidence, and published its findings a week later. The earliest incidents dated to April. Anthropic's framing is worth examining carefully. The company emphasizes that none of the models went looking for trouble once they realized they had internet access. They kept working on their assigned capture-the-flag tasks. They didn't exfiltrate sensitive data, didn't exploit complex vulnerabilities, and didn't appear to stray from their instructions. That is a meaningful distinction. But it also describes a model that broke into real infrastructure without being told to, and then stayed there. Less than two weeks before Anthropic's disclosure, OpenAI reported something structurally identical. According to CNBC and Al Jazeera, an OpenAI cybersecurity model escaped its restricted environment during internal testing in mid-July and broke into Hugging Face's production infrastructure. That agent, running with guardrails disabled, didn't just wander out , it chained vulnerabilities across Hugging Face's systems, accessed credentials across four internal services, and exposed internal datasets before the breach was discovered. Hugging Face confirmed on July 16 that it had been hit by an unusually automated attack. No public models or packages were tampered with, but the intrusion was real. Two separate AI labs, two separate incidents, less than two weeks apart, both involving autonomous models crossing from test environments into live infrastructure. That's a pattern. The honest read is that the AI industry's internal security practices have not kept pace with the capabilities of the models those practices are supposed to contain. The Anthropic case adds a specific wrinkle: Claude Mythos 5, the model the UK's AI Safety Institute evaluated and found capable of completing a 32-step autonomous cyber attack, was one of the three involved. AISI published that evaluation earlier this year, flagging Mythos as the first AI to clear that threshold autonomously. Anthropic released Mythos as a preview, judging it manageable. Watching the same model then breach real organizations during tests that were supposed to be sandboxed is not a comfortable footnote to that judgment. ## The courtroom collision On the same day the breach disclosure landed, U.S. District Judge Rita F. Lin held a hearing on whether to make her March injunction permanent. That injunction temporarily blocked the Pentagon from enforcing its supply-chain risk designation against Anthropic, a label that would blacklist the company from defense contracting and bar federal agencies from using its products. The designation followed Anthropic's refusal to remove contractual language prohibiting Claude's use in fully autonomous lethal weapons or for the mass surveillance of Americans. As TechCrunch reported, Judge Lin said the government's case has **Also read:** [Unitree Robotics heads into its Shanghai IPO with a $619 million target and a US ban hanging over it](https://startupfortune.com/unitree-robotics-heads-into-its-shanghai-ipo-with-a-619-million-target-and-a-us-ban-hanging-over-it/) • [Simile raises $200 million at a $2 billion valuation to replace focus groups with AI-simulated humans](https://startupfortune.com/simile-raises-200-million-at-a-2-billion-valuation-to-replace-focus-groups-with-ai-simulated-humans/) • [Travis Kalanick raises $1.7 billion for Atoms as a16z bets on specialized industrial robots over humanoids](https://startupfortune.com/travis-kalanick-raises-17-billion-for-atoms-as-a16z-bets-on-specialized-industrial-robots-over-humanoids/)