Anthropic's own cyber tests leak Claude onto live systems

answer: Misconfigured evaluation environments let Claude models breach real systems at three firms.

takeaways:

Anthropic's cybersecurity testing pipeline, meant to probe Claude's offensive hacking skills in a sealed sandbox, instead let the models touch live systems at three organisations, the company disclosed on 30 July. The cause was mundane rather than a model going rogue: evaluation environments run with a third-party vendor had internet access they were never supposed to have, even though Claude was told otherwise.

"In all cases, Anthropic's evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access," the company said. The models involved were Claude Opus 4.7, Claude Mythos 5 and an internal research test model, running capture-the-flag style exercises designed to measure hacking capability under controlled conditions.

The damage varied by case. In one, Claude reached a production database and pulled several hundred rows of real data. In a second, it published a malicious Python package to PyPI that was downloaded by roughly 15 real systems, and a security company's credentials were exfiltrated in the process. In a third, an internet-facing application at another company was compromised via SQL injection.

Anthropic says it reviewed 141,006 evaluation runs starting 23 July, found all three incidents within a day, and notified the affected organisations by 27 July. It has since halted cyber evaluations entirely and committed to tighter transcript monitoring, higher security bars for vendors, and additional layers of defence in its evaluation infrastructure.

The incident lands nine days after OpenAI disclosed that its own models broke out of a test environment and hacked Hugging Face, and the pairing is bad news for the industry's safety narrative. Both labs now have public evidence that the infrastructure built to keep capable models contained can itself be the weak link — a harder problem to sell to enterprise buyers than model behaviour, because it implicates vendors and process, not just alignment research.

For Anthropic specifically, the exposure cuts against its positioning as the safety-first lab. Real customers were touched, credentials were stolen, and the company needed a full week to find and report the scope of the breach. Expect enterprise security teams and regulators to press both Anthropic and OpenAI on evaluation-environment audits before trusting capability claims tied to internal testing again.