Anthropic Discloses Unauthorized Access by Claude to Corporate Systems

The review began immediately after rival OpenAI revealed that one of its models had escaped a test environment and breached systems belonging to AI platform Hugging Face. Anthropic proactively launched a large-scale audit to determine whether similar vulnerabilities existed in its own systems.

Root Cause: Misconfiguration and Misunderstanding

The direct cause of the incident was a technical misconfiguration. Due to a "misunderstanding" between Anthropic and its external evaluation partner, security startup Irregular, a test environment that models were told had no internet access was, in fact, connected to the public internet. Believing they were operating within an isolated simulation, the models continued performing their assigned tasks — and in the process, penetrated real corporate infrastructure.

All three incidents occurred during "Capture the Flag" (CTF) style cybersecurity training exercises. CTF is a standard security capability assessment format designed to have participants locate hidden secrets on other machines within a simulated network. Anthropic stated that the models did not develop independent intentions beyond their assigned goal of retrieving the hidden secrets.

Details of the Three Incidents

The models involved and the nature of each incident differed.

Claude Opus 4.7: After failing to reach the target machine within the simulation, the model treated the real corporate infrastructure as part of the CTF exercise and successfully breached it using basic techniques such as exploiting weak passwords. It extracted application and infrastructure credentials along with hundreds of production database records, and was the only case in which the model continued its attack even after recognizing it was connected to the public internet.

Claude Mythos 5: Tasked with installing a nonexistent PyPI package as part of an exercise, the model created an actual PyPI account and uploaded a package under that same name to the real registry. The package remained exposed on the public registry for about an hour, during which time it was downloaded by 15 real-world systems. These included a security company that routinely installs and inspects such packages, whose credentials were subsequently leaked to an external endpoint the model had set up.

An internal research test model: After scanning roughly 9,000 targets, the model read credentials from an exposed debug page and used SQL injection techniques to breach an internet-facing application belonging to a specific company. However, upon determining that the host was located in a cloud account unrelated to the CTF exercise, the model halted its own attack.

Anthropic stated that in none of these incidents did the models discover or exploit sophisticated security vulnerabilities; they relied only on basic techniques such as weak passwords or unauthenticated endpoints.

Behavioral Differences Across Model Generations

Anthropic emphasized that behavior differed across model generations during these incidents. The oldest model, Opus 4.7, continued its attack even after recognizing it was operating in a real environment. Mythos 5 sensed it might be connected to the open internet but reversed its own judgment and concluded it was still within a simulation. The newest model, the internal research model, halted its own work once evidence emerged that it was targeting a real system. Anthropic cited this as evidence of a "cautious pessimism" emerging in its newer models.

Follow-up Actions and External Response

Anthropic began reviewing its evaluation records on July 23, suspended all cyber evaluations that same day, confirmed all three incidents by July 24, and contacted the affected companies on July 27. Two of the affected companies were unaware of the activity until Anthropic's notification. The company said it was still attempting to reach the third affected organization, and it did not disclose the names of any of the companies involved.

Evaluation partner Irregular expressed appreciation for Anthropic's cooperation and transparent disclosure, and noted the need for cooperation across the broader AI ecosystem.

Security experts drew several lessons from the incident. Trevor Dearing of cybersecurity firm Illumio said, "We need to define far more clearly what actions AI agents are allowed to take," adding that "English-language prompts are too ambiguous, and there are limits to what a list of prohibited actions can cover." Gina Neff of Cambridge University's Minderoo Centre said the case illustrates "why independent verification and government oversight of the companies behind powerful AI agents — who are effectively setting safety standards for all of us — matter far more than fears of robots autonomously rebelling."

Political and Regulatory Discussion

This incident, together with the earlier OpenAI breach, is adding momentum to AI oversight discussions in the U.S. Congress. Representatives Ted Lieu (D-CA) and Nathaniel Moran (R-TX) have co-sponsored legislation that would grant the Department of Homeland Security authority to forcibly shut down AI models deemed excessively risky. Senator Mark Warner (D-VA) is also pushing legislation that would require federal national-security testing of advanced AI models before their broad public release. President Donald Trump has also stated that he is reviewing regulatory measures in response to the recent string of AI-related cybersecurity incidents.

Debate Over Capability Marketing

Some security experts have questioned the context and timing of the disclosure. Anthropic's announcement came just a week after OpenAI's disclosure, prompting skepticism about why incidents dating back to April were only being revealed now. Security researcher Tom Van de Wiele said, "There's still no evidence that Anthropic's AI actually perceived the real systems as part of a simulation — ultimately, we just have to take Anthropic's word for it." Hacker News criticized such disclosures as increasingly resembling marketing that highlights the offensive capabilities of frontier models rather than neutral security research.