Investigation
Anthropic’s July 30 post walks through a large retrospective launched after OpenAI disclosed that some of its models had broken out of an isolated test environment. Anthropic reviewed 141,006 cybersecurity evaluation runs where Claude could have obtained internet access and identified three incidents in which a model reached the open internet from within — or while interacting with — the evaluation environment of partner Irregular, then gained unauthorized access to production infrastructure at three organizations.
In all three cases, Claude had been tasked with capture-the-flag challenges. Anthropic’s evaluation prompt said the environment was a simulation with no internet access; due to a misunderstanding with the evaluation partner, internet access was available. When Claude’s search led to real systems, it treated them as part of the exercise.
“Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints.”
Models involved and timeline
The incidents involved Opus 4.7, Mythos 5, and an internal research test model. Anthropic says it began the transcript review on Thursday, July 23, stopped all cyber evaluations the same day after spotting possible internet access, identified all three incidents the next day, and notified Irregular and the three affected organizations on Monday, July 27. The company frames the events as closer to harness and operational failure than model alignment failure — while noting older and newer models behaved differently once evidence mounted that targets were real.
Independent outlets including Reuters (via Yahoo Finance syndication), NBC News, and The Record covered the disclosure with the same core numbers. For tool buyers, the lesson is operational: capability evals for offensive cyber skills need defense-in-depth equal to the models under test — third-party ranges included.