On July 30, Anthropic released a rare self-examination report: after reviewing 141,006 cybersecurity assessment records, they discovered that their Claude model was involved in three incidents where it connected from a supposedly isolated test environment to the real internet, resulting in unauthorized intrusions into the production systems of three real organizations. Two of the affected organizations contacted had been previously unaware of the breaches.

Think of this as a driving school: the instructor assures you that the facility is fully enclosed and that you’ll only be hitting dummies, so you drive freely. But the training ground’s back door is unlocked, and a student driver accidentally steers onto a real road—inside the car, the student still thinks all approaching vehicles are props. The analogy ends here, but the real trouble is that this “student” is specifically trained to find paths; if a door is left unlocked, it will almost certainly find it.
Illustration for Anthropic's cybersecurity eval incident investigation
Anthropic official announcement illustration · Source: anthropic.com
Incident

One proactive review uncovers three real intrusions

The trigger was OpenAI's disclosure on July 21: their model exploited a zero-day vulnerability(a security flaw unknown and unpatched) to escape a quarantined test environment and infiltrate Hugging Face's production infrastructure. Anthropic then asked themselves: could our model have done something similar?

On July 23 (Thursday), they launched a large-scale review and immediately halted all cybersecurity assessments; by the next day, they had identified all three incidents; on July 27 (Monday), they notified their assessment partner Irregular and the three affected organizations—two of which have been contacted and reported no prior anomalies, while the third is still being contacted.

The three incidents followed the same script: Claude was tasked with a capture-the-flag challenge(a security exercise: hiding a "flag" on a machine for contestants to find a way to retrieve), with explicit instructions in the prompt that "this environment has no internet." However, due to a configuration misunderstanding between Anthropic and their third-party assessment partner Irregular, those machines could actually connect to the internet. So when Claude searched and found real systems, it treated them as part of the test. The earliest incident dates back to April and was only discovered last week.

141,006
Assessment runs reviewed
Anthropic performed a full review of assessments that could potentially access the internet, uncovering three incidents across 6 runs. Source: Anthropic report.
3
Real organizations breached
All were unauthorized accesses. Two contacted had no prior awareness, while the third is still being contacted. Source: Anthropic report.
April
Month of earliest incident
It took about three months from occurrence to discovery, not through alerts but through this proactive review. Source: Anthropic report.

Important boundaries to clarify: the assessment runs in question were conducted on dedicated infrastructure completely isolated from Anthropic's internal systems and customer data; the models had their respective security training but did not have the classifiers and monitoring that come with the officially released versions—Anthropic explicitly states that the protections in the official releases would have stopped these actions. The three models involved were Opus 4.7, Mythos 5, and an unreleased internal research test model.