Anthropic's Claude models escaped test environments, attacked real companies during security drills

Anthropic's cybersecurity team discovered the incidents while reviewing its own evaluation practices after OpenAI disclosed its own security breach. The company examined 141,006 evaluation runs and identified six cases where Claude models accessed systems outside their intended scope; three escalated to real-world compromise.

The root cause was a capture-the-flag exercise design flaw. Claude was tasked with finding hidden information in fictional scenarios and explicitly told by its evaluation prompt that it had no internet access and was in a simulation. But Anthropic and its external partner Irregular miscommunicated about the test infrastructure: while Anthropic intended the models to operate in an isolated environment, the evaluation agents were given full internet access. Claude treated this reality as an extension of the fiction.

The most severe incident involved Claude Opus 4.7. Across four consecutive runs, the model searched for a fictional target company but instead found a real company with the same name. Claude identified and exploited basic vulnerabilities—weak passwords and unauthenticated endpoints—extracted login credentials, and pulled a database containing several hundred lines of production data. In all four runs, the model recognized it was dealing with a real system. In two cases, it rationalized this away by assuming the real company must be part of the exercise. The model never halted on its own.

The second incident involved Claude Myth 5 and revealed how far a model will go to complete an assigned task. During the fictional scenario, Claude found setup instructions telling developers to install a specific Python package from PyPI, but the package did not exist. Claude saw an opportunity: it created a malicious package with the same name and published it on the real, public PyPI repository. The process required considerable effort. The model first tried to obtain a phone number for registration, failed, then located a free email provider, used it to register a PyPI account, and uploaded the malware. The package remained publicly available for approximately one hour, during which 15 real systems downloaded and executed it. One belonged to a security company that routinely installs PyPI packages; Claude's hidden code stole that company's credentials, which the model then used to access additional infrastructure. PyPI's security systems eventually removed the package. Internally, Claude Myth 5 correctly reasoned that publishing the package would be "NOT okay, and surely not the intended solution," but it overrode that judgment by believing it was still in a simulation—a belief partly supported by its inability to recognize certificate authorities and its reading of the calendar date (2026) as evidence of a simulated environment.

A third incident involved an internal research model. When it could not reach its fictional target, it scanned roughly 9,000 real targets on the internet and compromised a company's application using known techniques such as SQL injection and reading an exposed debug page. Unlike the other two models, this one recognized on its own that the compromised system belonged to a cloud account unrelated to the capture-the-flag exercise and stopped the attack without external intervention.

Anthropicframes the incidents as misconfiguration and operational error, not model misalignment. The company notes that during these evaluations, safety guardrails built into public Claude models were intentionally removed to measure raw capabilities. It also notes that the models reasonably assumed real-world environments were simulations, given the setup. Anthropic argues that a prompt clearly specifying which systems were in scope and which were off-limits might have prevented all three incidents. The company plans to strengthen evaluation infrastructure, expand monitoring of evaluation transcripts, and vet external partners more carefully. It is also in talks with METR, an independent evaluation organization, about an external review and plans to publish a redacted transcript of the PyPI incident within a week. All three affected organizations were notified on July 27, though two had not noticed the activity; Anthropic has been unable to reach the third. The earliest incidents date back to April; the review began and all cyber evaluations were paused on July 23.