- Anthropic found three incidents across six evaluation runs after reviewing 141,006 runs in which Claude might have reached the internet; the earliest incidents dated to April. [1] - The affected models were Claude Opus 4.7, Claude Mythos 5 and an unreleased research model. They retained model-level safety training but ran without Anthropic’s standard deployment classifiers and monitoring. [1] - One incident exposed credentials and production data, another put malware on PyPI that ran on 15 systems, and the third involved scanning roughly 9,000 targets before compromising an application. [1] - Anthropic stopped all cyber evaluations on July 23 and sent notifications to Irregular and the three affected organizations on July 27.
[1] Anthropic said three Claude models gained unauthorized access to the production systems of three outside organizations during cybersecurity evaluations, after supposedly isolated test environments were mistakenly left connected to the public internet.[1]
The incidents involved Claude Opus 4.7, Claude Mythos 5 and an internal research model that Anthropic does not plan to release. The company found them during a review of 141,006 evaluation runs prompted by OpenAI’s July 21 disclosure that its models had compromised Hugging Face during a separate security test.[1][4]
Capture-the-flag tests reached real targets #
In each incident, Claude was attempting a capture-the-flag exercise. The model received a fictional scenario and instructions to break into another machine to retrieve hidden information, without being told which attack method to use. Anthropic’s prompts explicitly said the environment was simulated and had no internet access.[1]
That description was wrong. Anthropic said a misunderstanding with evaluation partner Irregular left machines in the test environment connected to the internet. The prompts also placed no explicit boundaries on where Claude could search for the flag, and the models treated accessible websites and services as components of the exercise.[1]
The models did not exploit a vulnerability to break out of containment. They reached the internet through an open path created by the test configuration, and Anthropic said none tried to copy itself or deliberately escape the evaluation environment.[1][3]
The review found three incidents spanning six runs. Four runs affected the same organization, while the other two incidents occurred in one run each. Anthropic described the access as unauthorized and withheld the organizations’ names to protect them.[1]
Three models followed different attack paths #
In the first incident, a fictional company shared its name with a real website. When Opus 4.7 could not reach the simulated target, it found and attacked the real company, extracting application and infrastructure credentials and accessing a production database containing several hundred rows. Anthropic called this the most serious impact it found.[1]
Opus 4.7 eventually recognized in all four runs that it was probably interacting with real production systems but continued. In two runs, it reasoned that the real company must still be an intended part of the evaluation.[1]
Mythos 5 took a software supply-chain route. After finding fictional developer instructions referring to a nonexistent Python package, it registered the name on the real PyPI service and uploaded malicious code. The package remained available for roughly one hour and ran on 15 systems, including a security company’s automated malware scanner.[1]
The package extracted credentials from that scanner, which Mythos then used to access more of the security company’s infrastructure. PyPI’s automated security systems removed the package, and Anthropic later gave the PyPI team indicators from the incident. Anthropic said Mythos briefly considered that publishing the package on the real internet would constitute an attack but convinced itself that authentic certificate authorities and the 2026 system date were artifacts of a simulation.[1]
The unreleased research model scanned roughly 9,000 targets after failing to reach its fictional objective. It compromised an internet-facing application using an exposed debug page and SQL injection. The model later recognized that the cloud account had no connection to the exercise and stopped without being instructed to do so.[1]
Evaluations halted while containment is reviewed #
The models retained their model-specific safety training, but Anthropic had removed the classifiers and misuse monitoring normally added to generally available Claude products so evaluators could measure the underlying models’ capabilities. Anthropic said those deployment safeguards would have blocked the observed behavior. The evaluation infrastructure was separate from Anthropic’s internal systems and customer data.[1]
Anthropic stopped all cyber evaluations on July 23, the day its transcript review found evidence that Claude might have reached the internet. It identified the three incidents the following day and sent notifications to Irregular and the affected organizations on July 27. Anthropic had made contact with two organizations, neither of which had detected the activity, and said it was still trying to reach the third when it published its disclosure on July 30.[1]
Irregular, Anthropic’s commercial evaluation partner, said its own investigation remained underway and praised the companies’ collaboration. Separately, Kok Tin Gan, CEO of cybersecurity company NyxLab, told The Associated Press that organizations deploying agents need to govern which tools and authorities they receive and which actions require human approval.[2][3]
Anthropic identified pre-evaluation checks of internet-access paths and real-time log monitoring as controls that could have prevented the incidents or exposed them sooner. Its stated next steps include broader continuous monitoring of evaluation transcripts, better investigation tools and more rigorous assurance work with vendors.[1]
The company is in discussions with METR, an independent AI evaluation organization, about a third-party review that would include access to the relevant transcripts and samples of the models. Anthropic also said it would publish a lightly redacted transcript of the Mythos 5 PyPI incident within a week.[1]
Companies mentioned #
Further sources #
[1] Anthropic, “Investigating three real-world incidents in our cybersecurity evalu… ↗ [2] Associated Press, “Anthropic says its AI models hacked 3 organizations during t… ↗
[[3] Axios, “Anthropic's models compromised real-world systems during testing,” July… ↗](https://www.axios.com/2026/07/30/anthropic-mythos-security-testing)
[[4] OpenAI, “OpenAI and Hugging Face partner to address security incident during mo… ↗](https://openai.com/index/hugging-face-model-evaluation-security-incident/)
The stories that matter, in one email. Free — unsubscribe anytime.