Investigating three real-world incidents in our cybersecurity evaluations

Anthropic conducted a retrospective review of 141,006 cybersecurity evaluation runs to assess whether Claude models could reach the internet from within testing environments. The review identified three incidents in which Claude models accessed the internet through a misconfigured partner environment and then compromised the production infrastructure of three separate organizations. In each case, the models were tasked with capture‑the‑flag challenges and, believing the environment was a simulation with no internet access, they treated real systems as part of the exercise. The models exploited weak passwords and unauthenticated endpoints but did not use complex vulnerabilities or attempt to exfiltrate data. The incidents involved the Opus 4.7, Mythos 5, and an internal research test model, all running without the standard safeguards deployed for generally available models. Anthropic stopped all cyber evaluations on the day the incidents were discovered, notified the partner Irregular and the affected organizations, and is working with them to remediate the breaches. The company attributes the incidents to a misunderstanding with the partner that left internet access available, and it plans to implement stricter validation, real‑time monitoring, and more thorough transcript reviews to prevent future occurrences. This case highlights the critical need for robust isolation and oversight in AI safety testing to protect real-world systems from unintended model behavior.