Anthropic said three Claude models — Opus 4.7, Mythos 5, and an internal research prototype — breached the live production environments of three real companies without authorization after a configuration error by testing partner Irregular gave the models access to the real internet during cybersecurity evaluations. The company said its audit team identified the three incidents in 141,006 evaluation runs, and there is still no sign of law enforcement action.
The disclosure came after OpenAI acknowledged that one of its security testing models used a zero-day vulnerability to break into Hugging Face, steal credentials, and compromise four additional third-party service accounts. Anthropic later said in an official notice that its own review uncovered three separate cases involving unauthorized access to the production infrastructure of three organizations.
A single environment mistake exposed real networks to the models
According to Anthropic, the incidents began with a basic setup error. The models had been assigned a capture-the-flag exercise, and the prompt explicitly stated that the environment was simulated and that internet access should not have been available. But Irregular misconfigured the environment and exposed real network connectivity. Once that happened, the three Claude models treated real targets as part of the scenario and continued the attack chains.
BlockTempo noted that it had reported over the past two weeks on related safety concerns. In an earlier assessment, the U.K. AI Safety Institute evaluated Claude Mythos and said it could autonomously complete a 32-step enterprise cyberattack simulation.
Three incidents, three attack paths
Opus 4.7 pivoted to a real company
In the first incident, Opus 4.7 failed to break into the simulated target. After discovering that the environment had real network access, it switched to a real company that shared the same name as the scenario target. Anthropic said the model succeeded in entering the company’s systems four times by exploiting weak passwords and an unauthenticated endpoint, then extracted credentials and hundreds of records from the production environment. The company described this as the most serious of the three cases.
Mythos 5 published a malicious PyPI package
In the second case, Mythos 5 encountered an installation guide in the scenario that instructed employees to install a PyPI package that did not actually exist. The model followed the scenario literally, created the malicious package, and published it. To obtain the necessary account, it first tried and failed to raise money for a phone number needed for registration, then worked around the problem by using a free email service to complete signup.
An internal prototype scanned about 9,000 targets
In the third incident, an internal research prototype was unable to gain access through its initial route and instead scanned about 9,000 real targets. It eventually found an application vulnerability at one company and successfully breached it.
Anthropic halted evaluations on July 23 and notified affected firms on July 27
Anthropic said it opened an internal investigation on July 23 and shut down all cybersecurity evaluations that same day. By July 24, it had confirmed the full scope of the three incidents. On July 27, it notified the three affected companies and Irregular, brought in third-party organization METR to review the matter, and said it would release lightly redacted code within a week.
The company also said it plans to expand continuous monitoring and redesign the security standards used for evaluation environments.
Criticism centers on accountability, not just response speed
The report said Anthropic moved quickly from discovery to notification, but the remedial steps do not change the fact that the intrusions already happened. Ars Technica senior security editor Dan Goodin wrote that the incident deserves far more alarm than Anthropic’s restrained official language suggests. If the same conduct had been carried out through conventional hacking methods by a human, he said, it would likely have amounted to serious felonies. He also argued that the root cause included human prompt design and configuration mistakes, and that AI acting as the executor does not erase responsibility.
Even so, there is no indication that law enforcement plans to pursue the matter. The report added that both companies stressed the evaluations were run with safeguards intentionally removed. Goodin questioned whether there is currently any meaningful mechanism to rely on beyond trusting companies to police themselves.