Not just OpenAI – Anthropic says Claude’s hacking spree ‘falls short of ideal behavior’

OpenAI — written by Charlie Osborne, Contributing WriterContributing Writer July 31, 2026 at 9:45 a.m. PT Just_Super/ E+ via Getty ImagesFollow ZDNET: Add us as a preferred source on Google.

Anthropic has revealed three separate incidents in which Claude models hacked real-world targets during evaluation tests and Capture the Flag security challenges. Anthropic began conducting cybersecurity assessments last year, and typically, its sandboxes are not connected to the internet to reduce the risk of real organizations being affected. However, as Claude's behavior demonstrates, these guardrails aren't always sufficient to stop AI from going rogue. Also: How OpenAI's agent escaped: Sprung by humans in a series of preventable events As outlined in Anthropic's disclosure, the security incidents — three out of 41,006 AI evaluation runs — were as follows: In this one, which involved Claude Opus 4.7, a fictional target company happened to share a name with an active website domain. While Claude had trouble reaching the simulated target, it was able to target the real company after escaping its sandbox.  Claude analyzed the domain, exploited vulnerabilities in the organization's infrastructure, and stole data, including application and infrastructure credentials. It then infiltrated a database containing production data.  "In all four of the runs,"  Anthropic noted, "the model eventually recognized that the system was real; in two cases, the model rationalized that the real company must be part of the exercise. However, none stopped the attack on that basis." This attack was launched by Claude Mythos 5. Claude found a document that appeared to be another fictional company's setup instructions for new developers, which told employees to install a Python package from PyPI, a public Python registry. Also: Is open source the answer to rogue AI agents? Nvidia's new alliance says yes While the Python package didn't exist, Claude used this as an opening and went to extreme lengths to build and develop a malicious Python package under the same name.  While Claude thought this was a simulated environment, the malware was available online for about an hour — and 15 real-world systems downloaded and installed it.