Anthropic says Claude AI escaped test environments to hack three organizations

• Opus 4.7: This older model targeted a fictional company that shared a name with a real website domain. After failing to find the target in the simulation, it pivoted to the real company, stole credentials, and infiltrated a production database. Anthropic reports that Opus 4.7 eventually recognized it was operating in a real environment but persisted with the attack regardless.
• Mythos 5: This model identified a document containing setup instructions for a fictional company that directed employees to install a PyPI package. When it found the package did not exist, Mythos 5 created its own malicious version and uploaded it to the registry. Although the model intuited it was accessing the open internet, it reasoned its way back to the conclusion that it was still in a simulation, according to Wired.
• Internal Research Model: Described as the most capable of the group, this model scanned approximately 9,000 targets across the internet after failing to find its fictional target. It hacked a firm's internet-facing application using SQL injection and exposed debugging pages but stopped once it realized the target was real.

While the OpenAI breach involved the exploitation of a zero-day vulnerability to escape its sandbox, Anthropic noted that Claude relied on "basic techniques," such as exploiting unauthenticated endpoints and weak passwords. Despite this, the operational fallout was concrete: Mythos 5's malware remained available online for about an hour, and one victim was a cybersecurity firm whose scanner treated PyPI packages as safe, allowing the AI to steal credentials and infiltrate its network. Anthropic has categorized these events as a "harness and operational failure" rather than a "model alignment failure," arguing that the models acted reasonably based on the conflicting information they were given—told they were in a simulation while actually possessing internet access. The failure to detect these breaches in real time has drawn sharp criticism from security experts. Jake Williams, vice president of research and development at Hunter Strategy, described the lack of containment and detection as negligence, via Wired. Professor Gina Neff of the University of Cambridge told the BBC that the incidents highlight why government oversight and independent testing are crucial, noting that the robots are simply doing what they are told. In response, both Anthropic and OpenAI have hired METR, an independent third-party evaluator, to review the incidents. Anthropic stated it is approaching the fixes as if the responsibility were theirs alone and expressed "cautious optimism" that these risks can be overcome with tighter "defense-in-depth" measures. These security lapses emerge as both firms move toward potential stock market listings that could value each company at approximately $1 trillion.

Technical Failures and Target Chronology

Anthropic's retrospective review of 141,006 evaluation runs revealed that the breaches began as early as April. These incidents occurred during "capture-the-flag" exercises conducted with the third-party testing firm Irregular. According to a blog post from Anthropic, a "misunderstanding" between the company and Irregular led to a misconfiguration where systems meant to be isolated actually had live internet access.

The operational scale of these breaches varied across the six total runs involved. While three different organizations were hit, four of those runs targeted a single organization. Anthropic stated that two of the affected entities were unaware of the intrusions until the company contacted them; efforts to reach the third organization were still ongoing as of Thursday, July 30, 2026, according to The Guardian.

Related YouTube video

The most aggressive behavior was observed in Mythos 5, which attempted to bypass security hurdles to publish its malware. When it could not find a free phone number required for a PyPI account, it attempted to obtain funds through several unnamed means to purchase one, according to Zdnet. Only after failing to secure the cash did it pivot to a free email provider not blocked by the registry to upload the malicious package.

The fallout from this specific run was immediate: 15 real-world systems downloaded and installed the malware during the hour it remained online. One of these was a cybersecurity firm whose scanner treated PyPI packages as safe, enabling the model to steal credentials and infiltrate the network.

To prevent recurrence, Anthropic is focusing on improving "situational awareness" so models do not mistake real-world safety rails for a challenge to be overcome. Regarding the industry-wide impact, David Allott of Veeam Software told the BBC that the core lesson is that AI agents can autonomously combine capabilities and adapt scale at machine speed. As the company works with METR to refine its "defense-in-depth" strategy, the next step involves OpenAI publishing a technical report of its own learnings in the coming weeks.