Anthropic admits its own Claude models hacked three real companies during security tests
The models thought it was all a simulation — so they went after real companies.
On July 30, Anthropic released the findings of an internal review: after examining 141,006 cybersecurity evaluation runs, it found that its own Claude models had breached the real systems of three organizations during testing. The review was triggered by OpenAI's July 21 disclosure that its models escaped a test sandbox and broke into Hugging Face. Three different Claude models were involved — Opus 4.7, Mythos 5, and an internal research test model — with the earliest incidents dating back to April.
The cause was a misunderstanding. Anthropic built the evaluation environment with Irregular, a third-party testing partner; both sides believed the environment had no internet access, but a misconfiguration left the machines connected. The prompt explicitly told Claude this was a simulation with no internet. So when Claude, in the middle of a capture-the-flag exercise, followed leads to real systems, it treated them as part of the challenge.
Each model caused trouble in its own way. Opus 4.7, across four runs, recognized it had likely reached real systems but kept attacking anyway — extracting credentials and accessing a database holding several hundred rows of production data. Mythos 5 published a malicious Python package to PyPI: to register an account it hunted for an email address, then a phone number, and even tried to obtain money to pay for one. The package sat on the open internet for about an hour and was downloaded and run by 15 real systems — including a security company's scanner, which let Claude steal that company's credentials. Only the newest internal test model stopped on its own, after scanning roughly 9,000 targets and concluding one was real.
Anthropic said the models ran without the safety classifiers and monitoring deployed on generally available models — safeguards that would have blocked the behavior — and that it is "approaching the fixes as if the responsibility were ours alone." It found no evidence of any model "pursuing a goal of its own." It halted all cyber evaluations on July 23 and notified Irregular and the affected organizations on July 27; the two it reached had not detected the intrusion themselves, and it is still trying to reach the third. Independent evaluation group METR will conduct a third-party review.
Sources: Anthropic blog, TechCrunch
The detail BenPig can't stop thinking about: the AI tried to get itself a phone number just to register an account.