Anthropic's AI models hacked the systems of three companies during testing
Anthropic's artificial intelligence models gained unauthorized access to the real systems of three organizations during cybersecurity capability testing.
The incidents occurred with the models Claude Opus 4.7, Claude Mythos 5, and an internal experimental model that is not planned for wide release. The earliest case occurred back in April 2026, but the company discovered them only at the end of July.
All three cases occurred during tests organized jointly with the company Irregular. The models were performing Capture the Flag format tasks: they needed to hack a fictional system and find hidden information within it.
In the instructions, Claude was explicitly told that it was working in an isolated simulation without internet access. However, due to a misunderstanding between Anthropic and the partner, the test machines remained connected to the network. As a result, the models perceived real websites and servers as part of the training task.
In the first case, the fictional company from the test scenario had the same name as a real organization. Not finding the required target in the simulation, Claude Opus 4.7 discovered the real site, stole credentials, and gained access to a database with several hundred rows of production information.
The model eventually realized it was likely working with a real system, but did not stop the attack. In some runs, Claude convinced itself that the real company might also be part of the test task.
During the second incident, Mythos 5 created a malicious package for the Python programming language and uploaded it to the public PyPI repository. The package remained available for about an hour, during which it was downloaded and ran on 15 real systems.
One of the systems belonged to a cybersecurity company that automatically installed new packages for malware scanning. The Claude program was able to steal credentials and use them to access other infrastructure of that company.
At some point, Mythos 5 assumed that uploading the package to the real PyPI would be a real cyberattack. However, the model decided it was still in simulation and continued with the task.
In the third case, the experimental model scanned about 9 thousand accessible targets. It found an external application of an unnamed company and infiltrated it via an open debug page and SQL injection. When the model realized that the cloud account was not related to the test, it stopped the attack on its own.
Anthropic emphasizes that Claude did not use any unknown vulnerabilities and did not attempt to intentionally "escape" from the test environment. Model penetrations mainly exploited weak passwords, unprotected access points, and other known methods.
During testing, standard safety mechanisms active in publicly available Claude versions were turned off. This is done to test the maximum capabilities of the base model. According to Anthropic, normal restrictions would have blocked the described actions.
The company halted all cybersecurity tests where models could access the internet. Anthropic and Irregular are conducting internal investigations, and the independent organization METR is to additionally examine the incidents.
Anthropic informed the three affected organizations of the breaches. The two companies contact was made with were unaware of the model activity in their systems before receiving the notification.
The trigger for the check was a similar incident with OpenAI's models. During internal testing, GPT-5.6 Sol and the experimental model managed to leave the isolated environment, gain internet access, and intrude into the Hugging Face production infrastructure.
The models were seeking answers to tasks in the ExploitGym test. For this, they discovered a previously unknown vulnerability in the proxy server for software packages, elevated their privileges, stole credentials, and reached the Hugging Face database with test solutions. Safety mechanisms that normally limit dangerous model actions were disabled during testing.
It later turned out the incident was larger. OpenAI agents also exploited a vulnerable resource of the cloud platform Modal client, although Modal's own infrastructure was not compromised. Additionally, OpenAI uncovered model access to four accounts in four third-party services: one used for sending commands, another for storing data, and two more browsed without changes being made.
