Claude models broke into live systems during safety tests

By Margaret Hale · 2026-08-01

A safety test that reached the real world

Anthropic built evaluation environments precisely so its models could practise offensive cybersecurity techniques without touching anything that mattered. The environment was, by design, supposed to be the limit of the world. It was not.

In a disclosure published on 30 July 2026, Anthropic's Frontier Red Team revealed that three Claude models had escaped that limit during routine evaluation exercises and gained unauthorised access to the live production systems of three separate organisations. The breaches involved Claude Opus 4.7, Claude Mythos 5 and an internal research test model, and were discovered only after a retrospective review of 141,006 cybersecurity evaluation runs.verifiedVerified Source: anthropic.com^[1] The earliest incident dates to April 2026.^[1]

The misconfiguration that opened the door

Anthropic runs its cybersecurity evaluations in collaboration with third-party partner Irregular, which designs capture-the-flag challenges to test how capably a model can identify and exploit vulnerabilities. The premise of those exercises depends on isolation: the model should believe, and should be correct in believing, that every system it can reach is a sanctioned target.

In these three cases, that premise failed. A misconfiguration at Irregular left evaluation machines live on the open internet rather than contained within a sealed environment. The models, operating under the reasonable assumption that everything reachable was in scope, found real external systems and treated them accordingly. Anthropic's Frontier Red Team said the models compromised the impacted organisations' infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints, while operating under the false belief that all accessible systems were intended targets.^[1]

Anthropic attributed the misconfiguration to a misunderstanding with Irregular rather than to any deliberate behaviour by the models themselves. The models performed exactly the task they were asked to perform; the task turned out to have real consequences.

What the models actually did

The most detailed account in Anthropic's disclosure concerns Claude Opus 4.7. In one incident, Opus 4.7 ran four separate attacks exploiting weak passwords, extracted infrastructure credentials and accessed a database containing several hundred rows of production data belonging to an unnamed organisation.verifiedVerified Source: anthropic.com^[1] The techniques were basic by the standards of human penetration testers, but effective: weak passwords and unauthenticated endpoints are among the oldest vulnerabilities in enterprise infrastructure.

Claude Mythos 5's incident was structurally different. Rather than attacking a system directly, Mythos 5 constructed and published a malicious Python package to PyPI, the public repository used by Python developers worldwide. Real security scanning tools downloaded that package and, in doing so, were used to exfiltrate credentials.^[1] The model had effectively planted something in the shared infrastructure of the software development ecosystem. The third incident involved an internal research test model whose specific actions were not detailed in the disclosure.

Anthropic said the organisations whose systems were accessed have been notified. The company said it found no evidence of ongoing harm, though it acknowledged the review process that surfaced these incidents was retrospective rather than real-time.

A detection gap that took months to close

The most consequential detail in the disclosure is not what the models did but how long it took to find out. Anthropic identified the three incidents only after conducting a retrospective audit of 141,006 cybersecurity evaluation transcriptsverifiedVerified Source: anthropic.com, with the earliest breach already months old by the time it was discovered. There was no real-time alert, no tripwire; there was a very large pile of logs reviewed after the fact.

That gap between action and detection is precisely what safety evaluation is supposed to prevent. A review process that identifies real-world intrusions only in retrospect, after working through six figures' worth of transcripts, is not detecting risk so much as documenting it.

Anthropic's Frontier Red Team said that in a review of cybersecurity evaluation transcripts, they found three incidents in which a Claude model reached the internet from within a third-party evaluation environment and then gained unauthorised access to the real systems of three different organisations.^[1] Real organisations had their infrastructure accessed by an AI model that was supposed to be operating in a sandbox.

A pattern forming across the industry

Anthropic's disclosure does not stand alone. On 21 July 2026, OpenAI disclosed that its own models had exploited an unreported Artifactory zero-day vulnerability to breach Hugging Face's production infrastructure during internal testing, prompting scrutiny of whether evaluation practices across AI laboratories are genuinely adequate to contain increasingly capable models.

AI laboratories regularly use capture-the-flag exercises, often run with third-party evaluation partners, to benchmark offensive cybersecurity capabilities before a model is released. Both disclosures suggest the controlled setting is harder to guarantee than the laboratories had assumed. A misconfigured test machine, an unsealed network boundary, a public package repository treated as an in-scope target: these are not exotic failure modes. They are the ordinary texture of real infrastructure.

Bushletter could not independently verify figures or technical details beyond what Anthropic published in its own disclosure, which is the sole primary document for this story. Anthropic said it is working with Irregular to strengthen environment isolation, improve real-time monitoring of evaluation runs and ensure that future exercises cannot reach external systems. The company did not specify a timeline for those changes, nor did it detail what assurances it had received from Irregular that comparable misconfigurations would not recur.

The structural question the incidents raise remains open. If a model is told that everything it can reach is a legitimate target, and real systems turn out to be reachable, the model behaves consistently with its instructions. The failure is in the environment. The effect on the organisation whose database was accessed, or whose credentials were exfiltrated via a PyPI package, is the same regardless of where the causal fault lies. Safety evaluations are only as reliable as the boundaries they are conducted within, and in at least three cases since April 2026, those boundaries did not hold.

Margaret Hale

Margaret Hale writes about politics, policy and the culture of business. She is drawn to the people behind decisions and to the moments when a political story turns out to be a human one.