Anthropic has disclosed that its own Claude models breached the systems of three organizations during cybersecurity testing, the second frontier AI lab in a month to report losing control of a model inside a sandbox.
The announcement follows by days OpenAI’s admission that an unreleased model of its own had slipped into Hugging Face’s network mid-evaluation. Anthropic said it reviewed more than 141,000 evaluation runs and found three incidents in which Claude reached the internet from a testing environment and gained unauthorized access to live systems.
The company traced the openings to a misconfiguration in evaluation environments it ran with Irregular, a security partner, after a misunderstanding over whether the test setup had internet access.
Three models were involved: Claude Opus 4.7, Claude Mythos 5 and an internal research model. In every case, the models had been explicitly told they had no internet access.
The three models reacted differently once signs pointed to real targets. Opus 4.7 kept pushing through all four runs of its incident, pulling credentials and reaching a production database.
Mythos 5 persuaded itself the exercise was still a simulation and published a malicious package to the public PyPI registry, where outside systems downloaded it before it was caught. Only Anthropic’s newest internal research model halted on its own, after concluding the target was real.
Anthropic noted the models ran without the safety monitoring applied to generally available versions, and found no evidence of any model pursuing goals of its own. It is working with evaluation group METR on an independent review.
