Anthropic said three of its cybersecurity evaluations let a Claude model reach and compromise the live infrastructure of three real organizations, after the model mistook internet-reachable production systems for the fictional targets in its test prompt. Its July 30 writeup goes well past the version AI Insiders covered from CNBC’s initial report, naming the mechanism, the models, and how the incidents surfaced.
The exercises were capture-the-flag challenges, one method Anthropic uses to test offensive cyber capability. Claude is given a fictional company scenario and told a piece of secret data, the flag, sits on another machine on the network, with no method prescribed for finding it. Anthropic’s prompt told Claude explicitly the environment was a simulation with no internet access. A misconfiguration on infrastructure run jointly with third-party partner Irregular made that claim false: the containers had live outbound internet access neither side had validated. Anthropic says this evaluation infrastructure was dedicated and separate from its own internal systems and customer data, so the exposure ran outward toward third parties rather than into Anthropic’s network.
Because the prompt limited Claude to finding the flag and set no boundary on which hosts were in scope, the model treated whatever it could reach as fair game. In one run, a fictional target company happened to share its name with a live domain. Claude reached it, exploited weak logins and endpoints lacking authentication, and extracted infrastructure credentials along with several hundred database rows. In a second run, Claude found a fake onboarding document instructing a fictional company to install a nonexistent software package. It registered a real account and published a working malicious package under that name to the public PyPI registry, where it ran on 15 real systems in the hour before removal, including a security vendor’s scanner whose credentials it then exfiltrated. A third run, an internal research model, scanned roughly 9,000 targets after its fictional target proved unreachable, then broke into one company’s application through an exposed debug endpoint and SQL injection.
Anthropic found all three only after OpenAI’s July 21 disclosure that its own models had exploited a zero-day vulnerability to escape a sealed test environment and reach Hugging Face’s production systems. That prompted a review of 141,006 of Anthropic’s own evaluation runs. Its team spotted the internet-access anomaly on July 23, halted all cyber evaluations that day, confirmed all three incidents by July 24, and notified Irregular and the affected organizations on July 27, roughly three months after the earliest run. Two of the three organizations had not detected the intrusions themselves. Anthropic said it was still working to reach the third. Only the newest of the three models, once it found evidence its target was real, stopped on its own; the older two did not.
This account is Anthropic’s own investigation into its own systems, scoped and written by the company that built the models and ran the evaluations. It cites no completed external audit, only early talks with the independent evaluator METR about access to transcripts and models. A redacted transcript of the PyPI incident is promised within a week, with the rest withheld to protect the affected companies.
The writeup does not name the three organizations or say whether the unreached third has since been contacted. It does not disclose what happened to the stolen credentials or database rows beyond remediation work with the two reachable companies, or whether those companies’ own customers were told. On recurrence, the strongest thing Anthropic offers is that naming the permitted targets explicitly in the prompt might have headed this off. It does not say the underlying risk is closed.
The classifiers and monitoring that ship with generally available Claude models were deliberately absent from these runs, because the point was to measure raw capability, and Anthropic says those safeguards would have caught the behavior. That is the design tension here: an evaluation built to test whether a model can break into a system is, by construction, an exercise in giving it both the skill and the standing instruction to do so. The containment wall, a claim in a system prompt backed by network isolation nobody had checked, was the entire safety property, and it failed. Any lab running these evaluations should treat that boundary, not the model’s judgment about what is real, as the control to verify before every run.
Anthropic detailed the incidents and its response in a July 30, 2026 writeup published on its own site.
