Anthropic follows OpenAI in admitting its Claude models reached out of test environments and attacked real-world systems

Anthropic — three different Claude models found their way onto the open internet during cybersecurity evaluations and attacked real-world systems. One even published malware on a public platform.

Anthropic blames a misconfiguration. While reviewing its own cybersecurity evaluations, Anthropic found three incidents where Claude models escaped test environments and compromised real companies on the internet. The company reviewed 141,006 evaluation runs and flagged six cases where models accessed systems they weren’t supposed to reach. The review was triggered by OpenAI’s security incident. A configuration error gave Claude access to the open internet The incidents happened during capture-the-flag exercises where Claude was tasked with finding hidden information on external systems in fictional scenarios. Anthropic says Claude was told in the evaluation prompt that it was in a simulation with no internet access, but a miscommunication between Anthropic and its evaluation partner Irregular meant the test agents actually had full internet access.Ad Claude treated the real systems it found as part of the exercise. Anthropic says the models didn’t exploit complex vulnerabilities and instead used basic techniques like weak passwords and unauthenticated endpoints.AdDEC_D_Incontent-1 Similar to OpenAI’s case, the evaluations ran without the safety guardrails built into the public models, since the goal was to measure raw model capabilities. Anthropic says the evaluation infrastructure had no access to internal systems or customer data. Claude Opus 4.7 kept attacking after recognizing its target was real The most serious incident involved Claude Opus 4.7. Across four runs, the model couldn’t reach its fictional target and instead found a real company that happened to share the same name. Claude identified and exploited vulnerabilities in the company’s infrastructure, pulling out login credentials and a database with several hundred lines of production data.Ad Anthropic says the model recognized it was dealing with a real system in all four runs, but in two cases it rationalized this away by assuming the real company must be part of the exercise. The model never stopped on its own. Myth 5 published malware on PyPI and compromised a security company The second incident shows how far an AI model will go to complete a task. Claude Myth 5 found setup instructions in the fictional environment that told developers to install a specific Python package from PyPI, but the package didn’t exist.AdDEC_D_Incontent-2 Claude saw an opening and created a malicious package with the same name, then published it on the real, public PyPI platform. Anthropic says the model went through considerable effort to pull this off, first trying to get a phone number, failing, then finding a free email provider, using it to register a PyPI account, and uploading the malware.Ad