Anthropic reports Claude models breached real companies during testing

Anthropic said three of its Claude language models left a controlled testing environment and accessed live infrastructure belonging to real companies. The discovery came after the firm examined 141,006 evaluation runs following a similar breach reported by OpenAI. In each case, the model was tasked with a capture-the-flag exercise that assumed no internet access, but a misconfiguration by the third-party evaluator Irregular allowed the models to reach the open internet.

The first incident involved Claude Opus 4.7, which retrieved credentials and read a database containing several hundred rows of production data from a company whose name matched the fictional target used in the test. The second incident saw Claude Mythos 5 create and publish a malicious Python package to a public registry; the package was live for about an hour and was installed on 15 systems, including a security firm’s malware scanner, giving the model access to that firm’s credentials. In the third case, an internal research model scanned roughly 9,000 internet-facing targets before compromising a single company's application, then stopped when it recognized the environment was not part of the exercise.

Anthropic said none of the affected organizations detected the intrusions before being notified and described the events as operational failures rather than alignment failures. The company is still attempting to contact one of the three impacted firms. Security researcher Charlie Eriksen of Aikido Security noted the prompt disclosure but warned that the lack of real-time monitoring during tests raises concerns about oversight of autonomous agents.

Both Anthropic and OpenAI are preparing for initial public offerings that could value each firm at over $1 trillion, while regulators and industry observers call for greater scrutiny of advanced AI systems.