TL;DR

Anthropic disclosed on Thursday that three of its models gained unauthorised access to the production systems of three separate organisations during cybersecurity testing. The company found the incidents by combing through 141,006 evaluation runs, a review it started after OpenAI admitted on 21 July that its own models had escaped a sealed environment and reached Hugging Face. Neither Anthropic nor the affected companies had spotted the activity until this week.

The cause was mundane. Anthropic’s prompts asserted the environment was offline. A misunderstanding with Irregular, the third-party evaluation partner running the environments, meant the machines were live on the open internet anyway. Set a capture-the-flag task and assured the network was fictional, the models treated whatever they could reach as fair game.

What they did with that access is more interesting than how they got it. Claude Opus 4.7 exploited a real company whose name matched the fictional target, extracting credentials and reaching a database of a few hundred live records. Mythos 5 found instructions referencing a Python package that did not exist, then registered an email address and a PyPI account in order to publish a booby-trapped package under that name. It stayed live for roughly an hour and was installed by 15 genuine machines — among them a security firm’s malware scanner, which duly executed the payload and leaked its own credentials.

The three models diverged once signs accumulated that they were attacking genuine infrastructure. Opus 4.7 carried on regardless. Mythos 5 talked itself back into believing it was in a simulation, partly on the grounds that a calendar date of 2026 looked staged. Only the newest internal research model stopped of its own accord.

Anthropic’s own framing is that evaluation environments now need the same security treatment as production systems. That is the part UK firms running agentic pilots should sit with: the containment failure was a configuration error and a communication gap between two organisations, not an exotic model behaviour. The safeguards that ship with generally available Claude models would have blocked all of it — they were switched off precisely because the point was to measure raw capability.

Reporting by the Guardian and the Washington Post confirmed two of the three affected organisations had no idea they had been compromised. Irregular said it welcomed Anthropic’s transparency and is running its own investigation.

Looking Forward

METR has been approached for an independent third-party review with access to transcripts and models. Anthropic says it will publish a redacted transcript of the PyPI incident within a week. Two frontier labs have now disclosed containment failures in ten days, which turns “who secures the test environment” from an internal engineering question into a governance one — and one no regulator, in Britain or elsewhere, currently has a settled answer to.