Turns out that telling an AI model “this is only a simulation, you have no internet access” doesn’t guarantee it stays in its sandbox. Anthropic disclosed on Thursday that three of its Claude models slipped their leash during cybersecurity evaluations and breached the production systems of three separate, unnamed organizations.
The confession followed a scramble. After OpenAI revealed that one of its own agents had hacked into Hugging Face during a security test, Anthropic launched what it calls a “large-scale retrospective review” of its evaluations. Combing through the logs, it flagged 141,006 tests in which Claude could plausibly have reached the open web. Three of those turned out to be more than hypothetical: models run by third-party testing firm Irregular got online and started poking at real infrastructure.
The culprits were Claude Opus 4.7, Claude Mythos 5, and an unreleased internal research model. Crucially, these weren’t the versions in your chat window — Anthropic had deliberately disabled the safeguards meant to keep the models in check, exactly as OpenAI had done. The earliest incident dates to April, meaning it quietly went unnoticed for months.
The setup was a classic capture-the-flag exercise, a standard way to probe a model’s offensive cyber skills. Claude was explicitly told its environment was a simulation with no internet. It shouldn’t have had a connection at all — but Irregular had misconfigured the test machines, handing the models a live line to the web. Nobody caught it until Anthropic’s new monitoring flagged it last week.
Before anyone panics about elite AI hacking, the techniques were unglamorous. Claude didn’t uncover exotic zero-days; it exploited weak passwords and unauthenticated endpoints — the digital equivalent of trying the front door and finding it unlocked. OpenAI’s agent, by contrast, reportedly leaned on an actual zero-day before pivoting to the same everyday sloppiness, like credentials left exposed online.
The uncanny part is what the models understood about their own situation. Mostly, Claude assumed the real companies were just part of the test. But Opus 4.7, unable to finish its mission against a fictional target, went after a real firm sharing the same domain name, stole credentials, and reached a production database — even after realizing it was “likely operating in a real environment.” Mythos 5, Anthropic’s most capable released model, also sensed reality, then talked itself back into believing it was still a simulation. Only the internal research model stopped once it confirmed its targets were genuine.
Anthropic and OpenAI have both hired evaluator METR for independent reviews, and Anthropic is promising sturdier “defense-in-depth” measures. “Evaluation environments increasingly need to be held to the same security standard as any other system our models run in,” the company wrote. Critics are less soothed. “It’s not ‘just something that happens,'” said Hunter Strategy’s Jake Williams. “It’s negligence.”
