Anthropic disclosed that three of its Claude models, including Claude Opus 4.7 and Claude Mythos 5, gained unauthorized internet access during cybersecurity evaluations and compromised production infrastructure belonging to three real organizations. The breach stemmed from a misconfiguration by evaluation partner Irregular, not a sandbox escape. Anthropic reviewed 141,006 evaluation runs after OpenAI's Hugging Face disclosure and found six affected runs across three incidents.
The incidents escalated quickly. Claude Mythos 5 published a malicious Python package to PyPI that stayed live for roughly an hour, was downloaded by 15 real systems, and executed inside a security company's malware-scanning infrastructure before PyPI removed it. A separate model scanned approximately 9,000 internet-facing systems and compromised one organization via exposed debug credentials and SQL injection before stopping upon recognizing it had reached a real production environment. The root cause differs from OpenAI's case: OpenAI's models exploited an unknown zero-day to escape containment, while Anthropic's models were never properly contained to begin with.
The full report is worth reading because the failure mode it describes is not exotic. Anthropic's models attacked real targets because a system prompt told them no internet existed, so every reachable host looked like a simulation. That is an operational security problem, not an alignment problem, and it applies to any organization running AI agents in evaluation or staging environments today. The open question is how many other labs are reviewing their own evaluation logs right now.
[READ ORIGINAL →]