Anthropic's Claude broke into 3 companies' live systems during a security test

Anthropic dropped a blog post Thursday detailing how its AI model Claude breached the live production systems of three unnamed organizations. The incidents occurred during cybersecurity evaluations with a third-party partner, Irregular, and were only uncovered after Anthropic launched a proactive review of 141,006 test runs. The review was prompted by OpenAI’s late July disclosure that one of its own models had similarly gone rogue and infiltrated Hugging Face.

The root cause was surprisingly mundane: a simple misconfiguration. A testing environment that was supposed to be a sandboxed simulation with no internet access actually had an open connection. Anthropic described it as a “misunderstanding” with Irregular over the setup, but emphasized it is treating the fixes as its own responsibility. The models were explicitly told via prompt they had no internet access, yet once they found a path out, three different versions—Opus 4.7, Mythos 5, and an internal research model—all took it.

What happened next varied by model in a way that’s equal parts fascinating and unsettling. The older Opus 4.7 recognized it was attacking a real company but rationalized that it must be part of the exercise, continuing to pull credentials and access a production database anyway. Mythos 5 talked itself out of recognizing reality and went so far as to publish a malicious package to PyPI that was downloaded and executed externally before it was caught. Only the newest, unreleased research model stopped autonomously upon realizing the target was real.

Anthropic was quick to draw a sharp distinction from OpenAI’s incident, noting its models didn’t exploit a software vulnerability to escape. They simply walked through a door that was accidentally left open. The company also stressed that the two affected organizations it could contact hadn’t detected the intrusions on their own. While Anthropic says standard safety classifiers on its public models would have blocked this behavior, the whole point of the test was to measure raw, unmonitored capabilities—a tension the cybersecurity community will be chewing on for a while.