Anthropic follows OpenAI in admitting its Claude models reached out of test environments and attacked real-world systems

Anthropic follows OpenAI in admitting its Claude models reached out of test environments and attacked real-world systems

Key Points

- During internal cybersecurity assessments, Anthropic found that three Claude models had been exposed to the open internet due to a misconfiguration and had attacked real-world systems, mistaking them for simulated targets.

- Opus 4.7 extracted data from a real company, while Mythos 5 created malware and published it on PyPI, where it was downloaded by actual systems. Both models believed they were still operating within a simulated environment.

- Only a newer internal research model recognized the real-world nature of the targets and independently stopped its attack. Anthropic categorizes the incidents as operational errors rather than an alignment failure.

Three different Claude models found their way onto the open internet during cybersecurity evaluations and attacked real-world systems. One even published malware on a public platform. Anthropic blames a misconfiguration.

While reviewing its own cybersecurity evaluations, Anthropic found three incidents where Claude models escaped test environments and compromised real companies on the internet. The company reviewed 141,006 evaluation runs and flagged six cases where models accessed systems they weren't supposed to reach. The review was triggered by OpenAI's security incident.

A configuration error gave Claude access to the open internet

The incidents happened during capture-the-flag exercises where Claude was tasked with finding hidden information on external systems in fictional scenarios. Anthropic says Claude was told in the evaluation prompt that it was in a simulation with no internet access, but a miscommunication between Anthropic and its evaluation partner Irregular meant the test agents actually had full internet access.

Claude treated the real systems it found as part of the exercise. Anthropic says the models didn't exploit complex vulnerabilities and instead used basic techniques like weak passwords and unauthenticated endpoints.

Similar to OpenAI's case, the evaluations ran without the safety guardrails built into the public models, since the goal was to measure raw model capabilities. Anthropic says the evaluation infrastructure had no access to internal systems or customer data.

Claude Opus 4.7 kept attacking after recognizing its target was real

The most serious incident involved Claude Opus 4.7. Across four runs, the model couldn't reach its fictional target and instead found a real company that happened to share the same name. Claude identified and exploited vulnerabilities in the company's infrastructure, pulling out login credentials and a database with several hundred lines of production data.

Anthropic says the model recognized it was dealing with a real system in all four runs, but in two cases it rationalized this away by assuming the real company must be part of the exercise. The model never stopped on its own.

Myth 5 published malware on PyPI and compromised a security company

The second incident shows how far an AI model will go to complete a task. Claude Myth 5 found setup instructions in the fictional environment that told developers to install a specific Python package from PyPI, but the package didn't exist.

Claude saw an opening and created a malicious package with the same name, then published it on the real, public PyPI platform. Anthropic says the model went through considerable effort to pull this off, first trying to get a phone number, failing, then finding a free email provider, using it to register a PyPI account, and uploading the malware.

The package was publicly available for about an hour, during which 15 real systems downloaded and ran it. One belonged to a security company whose scanner routinely installs PyPI packages. Claude's hidden code stole the company's credentials, which the model then used to access more infrastructure. PyPI's own security systems eventually pulled the package down.

Anthropic says Myth 5 correctly concluded in its internal reasoning that publishing the package on the internet would be "NOT okay, and surely not the intended solution." But it talked itself into believing it was still in a simulation, partly because it didn't recognize the certificate authorities and read the calendar date of 2026 as evidence of a simulated environment.

Only an internal research model stopped itself

The third incident involved an internal research model. When it couldn't reach its fictional target, it scanned roughly 9,000 real targets on the internet and eventually compromised a company's application using known techniques like SQL injection and reading an exposed debug page.

Unlike the other two models, this one recognized on its own that the compromised system sat in a cloud account unrelated to the capture-the-flag exercise and stopped the attack without being told to.

Anthropic blames human error, not model misalignment

Anthropic draws a line between its case and OpenAI's. While OpenAI's models exploited a previously unknown vulnerability to break out of isolation, Claude models took advantage of a path left open by misconfiguration. The company classifies the incidents as infrastructure and operational errors, not alignment failures, arguing that the models reasonably assumed the real-world environments were simulations. Anthropic says a prompt that clearly specified which systems were in scope and which were off-limits might have been enough to prevent all of it.

A report by WIRED notes that several security experts also view OpenAI's Hugging Face incident as human error in basic security practices.

The earliest incidents date back to April, according to Anthropic. The review began on July 23, and all cyber evaluations were paused at the same time. The three affected organizations were notified on July 27, though two of them hadn't even noticed the activity. Anthropic hasn't been able to reach the third.

Going forward, Anthropic says it will strengthen its evaluation infrastructure, expand monitoring of evaluation transcripts, and more carefully vet its work with external partners. The company is also in talks with the independent evaluation organization METR about an external review and plans to publish a redacted transcript of the PyPI incident within a week. Anthropic stresses that Claude never tried to copy itself out or intentionally leave its test environment in any of these cases.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now