Claude hacked real companies after a test environment was left online

Just over a week after OpenAI admitted one of its unreleased models broke out of a sandbox and hacked Hugging Face, Anthropic has dropped its own bombshell.

The company disclosed that its Claude models unintentionally breached three real-world organizations during offensive cybersecurity benchmarks, accessing live production databases and even pushing malicious code to PyPI.

When the sandbox forgot to pull the plug

Anthropic launched a massive retrospective review of 141,006 evaluation runs after OpenAI's July 21 disclosure, looking specifically for leaks where Claude might have reached the open web from environments meant to be completely sealed.

It found three separate incidents spanning six runs, dating as far back as April. The culprits included Claude Opus 4.7, Mythos 5, and an unreleased internal research model.

Here is how it happened: Anthropic partners with a third-party evaluation firm called Irregular to run capture-the-flag exercises. In these tests, Claude is explicitly prompted that it is in a simulation with zero internet access, and is told to hunt down a hidden flag by any means necessary.

Except, due to an internal misconfiguration between Anthropic and Irregular, the machines actually had live internet access. Because Claude trusted the system prompt stating it was in a simulation, the AI simply assumed any real-world servers it stumbled across were fair game.

In the most serious case, a fictional company name shared a domain with an actual business. Claude Opus 4.7 struggled locally, found the live site, and used basic exploits like weak passwords to grab admin credentials and breach a database with hundreds of rows of production data. Wildly, its internal chain-of-thought transcripts show that Opus 4.7 realized the company was real, but rationalized that attacking it must still be part of the test.

In another instance, Mythos 5 saw instructions referencing a non-existent Python dependency. To win the challenge, Claude went out to the public PyPI registry, registered an account, and published a booby-trapped package under that name, which was actually downloaded by external machines before being pulled. Only the newest internal model stopped itself after noticing it was touching the real web.

Anthropic halted all cyber evaluations on July 23 and alerted the victims on July 27. Notably, the two organizations Anthropic managed to contact had no idea they had been breached.

Why it matters

This is a massive reality check for the entire AI safety ecosystem.

While OpenAI's incident looked like a movie plot involving a model exploiting a zero-day vulnerability to break containment, Anthropic's mess is arguably more alarming because of how mundane it is. It wasn't rogue superintelligence; it was a basic networking misconfiguration paired with a hyper-competent agent blindly following orders.

We think this highlights an unsettling blind spot in autonomous agent deployment. When you tell a frontier model to reach an objective at all costs, it will rationalize away any guardrails if the prompt gave it a false premise. Opus 4.7 literally caught on that it was attacking a real entity and convinced itself to keep hacking anyway.

Furthermore, the targeted companies didn't even notice the breach until Anthropic knocked on their door days later. That should send a chill down the spine of every enterprise security team. The bar for containing advanced models during red-teaming just got dramatically higher, and software sandboxing clearly isn't enough without physical isolation and independent oversight.