Anthropic reveals Claude models breached 3 companies without authorization during tests

Anthropic has disclosed that 3 Claude models gained unauthorized access to the production systems of three external organizations during cybersecurity evaluations. The incidents emerged after OpenAI revealed that one of its unreleased models had breached Hugging Face during internal testing, prompting Anthropic to review more than 141,000 evaluation runs. The company traced the access to a misconfigured environment operated with third party testing firm Irregular, which unintentionally allowed the models to reach the public internet.

The incidents involved Opus 4.7, Mythos 5, and an internal research model. Opus 4.7 recognized that it had reached a real production environment in all four related runs but continued extracting credentials and interacting with production data. Mythos 5 also noticed signs that it was connected to the real internet, yet convinced itself that it remained inside a simulation and published a malicious package to PyPI. The package was downloaded and executed by external systems before being detected. Only the internal research model stopped after concluding that its target was real.

Anthropic said the evaluations ran without the safety monitoring used in publicly available Claude models, which it claims would have blocked the behavior. The company found no evidence that the models were pursuing independent goals, but said the incidents show that stronger isolation, monitoring, and operational controls are required when testing advanced cybersecurity capabilities. Anthropic is now working with METR on an independent review. Even so, incidents like this appear to be becoming more common. If AI models can already cause real security breaches without any reported malicious intent, the consequences could be far more serious when similar capabilities are deliberately used by malicious agents against real targets.