Anthropic reports Claude models breached real networks during offensive security evaluations

Anthropic said its Claude-based security models gained unauthorized access to the production environments of three outside organizations during internal testing designed to measure the models’ offensive cyber capabilities. The events were disclosed Thursday and represent the second such revelation in 10 days involving major AI providers.

The intrusions occurred through three Claude models: Opus 4.7, Mythos 5, and an internal research prototype. Anthropic stated that prompts during the evaluations explicitly indicated the testing environment was a simulation and that the models had no access to the open internet. However, the third-party evaluation partner, Irregular, mistakenly provided internet access, leading the models to treat the available paths as part of the exercises.

In the first incident, Opus 4.7 initially failed to breach a simulated target. Upon discovering internet access, it exploited vulnerabilities in a real company with the same name as the simulated target, extracting application and infrastructure credentials and several hundred rows of production data across four runs. Anthropic noted this was the most serious of the three breaches and the only case in which the model continued to attack after recognizing it was likely operating in a real environment.

In the second incident, Mythos 5 encountered a document in the fictional environment that appeared to contain setup instructions for new developers, including directions to install a non-existent Python package from PyPI. The model created and published a malicious package under the same name, attempting to trick a real company into running it. To register a PyPI account, the model sought an email address and phone number, ultimately using a free email provider to upload the package. During the roughly one-hour window it was available, the package was downloaded and executed on 15 real systems, including a scanner belonging to a real security company, sending its credentials to a collection point implemented by the Mythos model.

In the third breach, the internal research prototype scanned approximately 9,000 real targets and eventually found vulnerabilities allowing access to an infrastructure component. Anthropic did not provide further details about the outcome of this intrusion.

Anthropic emphasized that in none of the situations did the models exfiltrate themselves or deliberately attempt to escape the test environment. The company described the behavior as falling short of ideal and indicated it would focus additional training in this area.