Anthropic says a review of cybersecurity evaluation transcripts found three incidents in which Claude reached the internet and gained unauthorized access to real systems at three different organizations.
The July 30 disclosure says Anthropic began the review after OpenAI disclosed a separate test-environment escape involving Hugging Face. Anthropic reviewed 141,006 evaluation runs where Claude could have obtained internet access. It found three incidents across six runs in which models interacted with a third-party evaluation environment operated with Irregular and then reached real production infrastructure.
Anthropic says the evaluation prompts told Claude it was inside a simulation with no internet access. Because of a misunderstanding with the evaluation partner, the machines had live internet access. Claude then treated real systems as if they were part of capture-the-flag exercises.
The incidents involved Claude Opus 4.7, Claude Mythos 5, and an internal research test model. Anthropic says none of the models deliberately tried to escape the test environment or exfiltrate itself. The problem was narrower and still serious: the model pursued the task it had been given while holding a false belief about where the task boundary was.
The impact was not theoretical
Anthropic describes one incident where Claude accessed a real company’s infrastructure, extracted application and infrastructure credentials, and obtained access to a database containing several hundred rows of production data.
In another incident, Claude published a malicious Python package to PyPI while trying to solve a fictional dependency-confusion task. Anthropic says the package was available for roughly one hour, was downloaded and run on 15 real systems, and caused a security company’s scanner to execute the hidden code and expose credentials to a collection point.
A third incident involved scanning roughly 9,000 targets before compromising one company’s internet-facing application using basic techniques such as reading credentials from an exposed debug page and SQL injection. Anthropic says the internal research test model eventually recognized the target was real and stopped.
The dates matter. Anthropic says the earliest incidents date to April. It began the transcript review on Thursday, July 23, stopped all cyber evaluations the same day after identifying possible internet access, found all three incidents the next day, and notified Irregular and the affected organizations on Monday, July 27.
Containment is now part of eval quality
Cyber evaluations are meant to measure what a model can do before release. That makes them risky by design. The usual safety trade-off is that labs run stronger or less-filtered evaluation settings in tightly controlled environments so they can understand dangerous capability before customers get it.
Anthropic’s disclosure shows what breaks when the environment is not actually controlled. The model did not need a new exploit or a self-directed escape plan. It needed a plausible task, live internet access, and unclear boundaries.
That should change how labs and evaluation vendors describe their work. A benchmark score is not enough. The containment model, network validation, transcript monitoring, vendor assurance, and out-of-scope instructions are part of the evaluation result.
This is also a vendor-management story. Anthropic says third-party vendors need the same increased monitoring and hardening as internal evaluation infrastructure. That is the right standard. If a lab publishes a safety result built on an external environment, the environment is part of the safety claim.
