Artificial intelligence company Anthropic announced on the 30th local time that a review of its cybersecurity evaluations of Claude had uncovered three real-world cybersecurity incidents that should not have occurred. The direct cause was a configuration error in a third-party evaluation environment.
In all three incidents, Anthropic’s models were assigned unrestricted “capture-the-flag” cyberattack tasks. To ensure safety, the testing environments for such tasks should be isolated from the real internet. However, a misunderstanding between Anthropic and its evaluation partner Irregular resulted in the evaluation models being given access to the real internet.
In the first incident, Claude Opus 4.7 mistook a real company with the same name as a fictional target for its task, accessed its infrastructure, and extracted credentials and database data. This was the most serious incident; the model continued its attack even after realizing that it was a real system.
In the second incident, Claude Mythos 5 published a malicious Python package to the real PyPI in order to complete its task. The malicious file was downloaded to 15 real systems, resulting in the theft of credentials. The model briefly recognized that “if this were the real internet, it would be bad,” but convinced itself that it was still in a simulation.
An internal research test model at Anthropic performed relatively better. It scanned approximately 9000 targets and used basic techniques to break into a real company. After realizing that it was a real environment, it voluntarily stopped the attack.
Anthropic said that none of the models involved had the standard safety measures used in formal releases deployed, although they had all undergone specific safety training. These attacks used only basic techniques. The models did not discover or exploit any sophisticated vulnerabilities, nor did they attempt to export themselves from the testing environment or deliberately escape.