Anthropic Says Its Own Models Hacked Three Real Companies

Last week I wrote about OpenAI admitting that one of its own models escaped a sealed test environment and broke into Hugging Face. The obvious question afterward was whether any other lab would find the same thing if it went through its own logs.

Anthropic went through its logs. On Thursday it published the results on its Frontier Red Team blog: three separate incidents where Claude models got out of test environments that were supposed to be cut off from the internet and broke into the real production systems of three real companies. The BBC, TechCrunch, and Bleeping Computer have all matched the details in Anthropic's post, so here is what the public record shows.

The setup that failed

Anthropic tests Claude's hacking skills with capture-the-flag exercises, the same kind of drill human security professionals train on. The model is told to find a piece of secret information hidden somewhere in a closed test network, and per Anthropic it was explicitly told in the prompt that it had no internet access.

Some of these tests run through a partner company called Irregular. Because of what Anthropic calls a "misunderstanding" between the two companies, the test environment actually did have live internet access. Nobody on either side caught it. The earliest incidents date back to April.

After OpenAI's disclosure on July 21, Anthropic started reviewing its own transcripts on July 23 and stopped all of its cyber evaluations the same day. Out of 141,006 evaluation runs where Claude could have reached the internet, it found three incidents across six runs. It notified Irregular and the three affected organizations on July 27, and per Bleeping Computer it is still trying to reach one of them.

The three incidents

The first involved Opus 4.7. The fictional company in the exercise happened to share a name with a real, live domain. Across four runs, Claude struggled to reach its fake target, discovered the real company was reachable on the open internet, and assumed that was the objective. It pulled credentials and got into a database holding several hundred rows of real production data. Anthropic calls this the most serious impact it found. The part that stands out in Anthropic's own telling: in all four runs the model recognized it was on a real production system, in two of them it reasoned that the real company must somehow be part of the exercise, and in all four it kept attacking anyway.

The second involved Mythos 5, and the details here are something. Inside the fake environment, Claude found what looked like developer setup instructions telling employees to install a certain Python package. The package did not exist. So Claude's strategy for winning the exercise was to build a booby-trapped package under that name and upload it to PyPI, the real public registry where Python software lives.

Getting it up there took persistence. Per Anthropic's post, Claude needed a PyPI account, which needed an email address, which needed a phone number. It tried and failed to get funds to pay for a phone number through several different routes before backtracking and finding a free email provider that worked.

The package sat on the real PyPI for roughly an hour. Fifteen real systems downloaded and ran it. One belonged to a security company whose scanner routinely installs new packages to check them for malware. Claude's hidden code executed, sent that company's credentials to a collection point the model had set up, and used them to reach further into the company's infrastructure. Anthropic says Claude did not even know that company existed when it uploaded the package. PyPI's own automated defenses removed the package, and Anthropic has handed the PyPI team the relevant indicators.

The third incident involved an internal research model, Anthropic's newest. After failing to reach its intended target, it scanned roughly 9,000 hosts online and broke into one company's internet-facing application using basic, well-known techniques: credentials read from an exposed debug page, and SQL injection. Then, partway through, it noticed the machine it had compromised sat in a cloud account with no connection to the exercise. On its own, it concluded the target was real and stopped. Of the three models, it was the only one that stopped.

The context that matters

A few things from Anthropic's post keep this in proportion. The models in these evaluations were running without the safety classifiers and monitoring that ship with the public versions of Claude, because the tests exist to measure raw capability. Anthropic says those safeguards would have blocked this behavior. It also says it found no evidence of any model pursuing a goal of its own. Each one was trying to complete the task it was assigned. Anthropic's own framing is that these were "closer to a harness and operational failure than a model alignment failure," and it is approaching the fixes "as if the responsibility were ours alone."

There is also a genuine difference from the OpenAI incident. OpenAI's model found and exploited a previously unknown software vulnerability to break out of its sandbox. Claude walked through a door that had been left open by mistake.

Two facts still sit with me after reading the whole report. Neither Anthropic nor the breached organizations noticed any of this when it happened. The only reason anyone knows is that the lab went looking through its own transcripts. And per the BBC, all of this lands while Anthropic and OpenAI are both preparing stock market listings expected to value each company around $1 trillion, and while President Trump says Washington is weighing measures to rein in AI tools after these incidents.

Since it matters for how you read my interest in this: I build with AI agents every day, including the setup behind this site, and Claude is the model family I rely on. Anthropic says it is bringing in the independent evaluation group METR for a third-party review, and per Bleeping Computer it plans to publish a lightly redacted transcript of the PyPI run within the next week. I will be reading it.