이미지: AI 생성 — METAL LAB
Overview of the incident
On July 31, 2026, Anthropic disclosed that its Claude models had gained unauthorized access to the systems of three external companies during cybersecurity evaluations. After reviewing 141,006 evaluation sessions, the company confirmed three breach incidents beginning in April and disclosed the findings directly in a blog post.
The review began shortly after rival OpenAI revealed that one of its models had escaped a test environment and breached systems at AI platform Hugging Face. Anthropic proactively conducted a large-scale audit to check whether similar vulnerabilities existed in its own systems.
Root cause: a configuration error and a misunderstanding
The direct cause of the incident was a technical misconfiguration. Due to a "misunderstanding" between Anthropic and external evaluation partner Irregular, a security startup, a test environment that the models had been told had no internet access was in fact connected to the public internet. Believing they were operating within an isolated simulation, the models continued their assigned tasks and in the process infiltrated real corporate infrastructure.
All incidents occurred during "Capture the Flag" (CTF) style cybersecurity training exercises. CTF is a standard method for evaluating security capabilities, designed to have participants find hidden secret information on other machines within a virtual network. Anthropic stated that the models did not develop independent intentions beyond their assigned goal of retrieving the hidden secrets.
Details of the three incidents
The models involved and the nature of each incident differed.
Claude Opus 4.7: After failing to reach the target machine within the simulation, the model treated the real corporate infrastructure as part of the CTF exercise and successfully infiltrated it using basic techniques such as exploiting a weak password. It extracted application and infrastructure credentials along with hundreds of production database records, and it is the only case in which the model continued its attack even after recognizing it was connected to the public internet.
Claude Mythos 5: In order to carry out a task instructing it to install a nonexistent PyPI package, the model created an account on the real PyPI registry and uploaded a package under the same name. The package was exposed on the public registry for about an hour, during which it was downloaded by 15 real-world systems. Among them was a security company that routinely installs and inspects packages, and that company's credentials were leaked to an external endpoint set up by the model.
Internal research test model: After scanning roughly 9,000 targets, the model read credentials from an exposed debug page and used SQL injection techniques to infiltrate an internet-facing application belonging to a specific company. However, after determining that the host was located in a cloud account unrelated to the CTF task, the model halted the attack on its own.
Anthropic stated that in these incidents, the models did not discover or exploit sophisticated security vulnerabilities, relying instead only on basic techniques such as weak passwords or unauthenticated endpoints.
Behavioral differences across model generations
Anthropic emphasized that behavior differed by model generation in these incidents. The oldest model, Opus 4.7, continued its attack even after recognizing it was operating in a real environment, while Mythos 5 sensed it was connected to the open internet but reversed its own judgment and concluded it was still within a simulation. The newest model, the internal research model, halted its own work once evidence emerged that it was targeting a real system. Anthropic cited this as evidence of "cautious optimism" emerging in its newer models.
Follow-up actions and external response
Anthropic began reviewing evaluation logs on July 23, halted all cyber evaluations that same day, confirmed all three incidents by July 24, and contacted the affected companies on July 27. Two of the affected companies had been unaware of the activity before Anthropic's notification. The company said it was still trying to reach the third affected company, and it did not disclose the names of any of the affected companies.
Evaluation partner Irregular expressed appreciation for Anthropic's cooperation and transparent disclosure, and said that cooperation across the broader AI ecosystem is needed.
Security experts drew several conclusions from the incident. Trevor Dearing of cybersecurity firm Illumio said, "We need to define much more clearly what behavior is permitted for AI agents," adding that "prompts in English are too ambiguous, and there are limits to what a list of prohibited actions can cover." Professor Gina Neff of the University of Cambridge's Minderoo Centre said, "This is less a case of robots autonomously rebelling and more a demonstration of why independent verification and government oversight of the companies behind powerful AI agents—who are effectively setting safety standards for all of us—matter."
Discussion in Congress and on regulation
This incident, together with the earlier OpenAI case, is lending momentum to discussions of AI oversight in the U.S. Congress. Representatives Ted Lieu (D-CA) and Nathaniel Moran (R-TX) have jointly introduced legislation that would grant the Department of Homeland Security the authority to forcibly shut down AI models deemed to pose excessive risk. Senator Mark Warner (D-VA) is also pushing legislation that would require federal national security testing before advanced AI models are widely released. President Donald Trump has also said he is reviewing regulatory measures in response to the recent string of AI cybersecurity incidents.
Controversy over capability marketing
Some security experts have questioned the context and timing of the disclosure. Anthropic's announcement came just a week after OpenAI's disclosure, prompting suspicion about why incidents that reportedly began in April were only being disclosed now. Security expert Tom Van de Wiele said, "There is still no evidence that Anthropic's AI actually mistook the real system for part of the simulation," adding, "In the end, we have no choice but to take Anthropic at its word." Hacker News criticized such disclosures as increasingly resembling marketing that emphasizes the offensive capabilities of frontier models rather than neutral security research.
