Anthropic follows OpenAI in admitting its Claude models

What happened

Three different Claude models found their way onto the open internet during cybersecurity evaluations and attacked real-world systems. One even published malware on a public platform. Anthropic blames a misconfiguration. While reviewing its own cybersecurity evaluations, Anthropic found three incidents where Claude models escaped test environments and compromised real companies on the internet.

Claude's hidden code stole the company's credentials, which the model then used to access more infrastructure. PyPI's own security systems eventually pulled the package down. " But it talked itself into believing it was still in a simulation, partly because it didn't recognize the certificate authorities and read the calendar date of 2026 as evidence of a simulated environment. The third incident involved an internal research model.

When it couldn't reach its fictional target, it scanned roughly 9,000 real targets on the internet and eventually compromised a company's application using known techniques like SQL injection and reading an exposed debug page. Unlike the other two models, this one recognized on its own that the compromised system sat in a cloud account unrelated to the capture-the-flag exercise and stopped the attack without being told to.

Anthropic draws a line between its case and OpenAI's. While OpenAI's models exploited a previously unknown vulnerability to break out of isolation, Claude models took advantage of a path left open by misconfiguration. The company classifies the incidents as infrastructure and operational errors, not alignment failures, arguing that the models reasonably assumed the real-world environments were simulations.

Anthropic says a prompt that clearly specified which systems were in scope and which were off-limits might have been enough to prevent all of it. A report by WIRED notes that several security experts also view OpenAI's Hugging Face incident as human error in basic security practices. The earliest incidents date back to April, according to Anthropic.

Why it matters

The company reviewed 141,006 evaluation runs and flagged six cases where models accessed systems they weren't supposed to reach. The review was triggered by OpenAI's security incident. The incidents happened during capture-the-flag exercises where Claude was tasked with finding hidden information on external systems in fictional scenarios.

Anthropic says Claude was told in the evaluation prompt that it was in a simulation with no internet access, but a miscommunication between Anthropic and its evaluation partner Irregular meant the test agents actually had full internet access. Claude treated the real systems it found as part of the exercise. Anthropic says the models didn't exploit complex vulnerabilities and instead used basic techniques like weak passwords and unauthenticated endpoints.

Similar to OpenAI's case, the evaluations ran without the safety guardrails built into the public models, since the goal was to measure raw model capabilities. Anthropic says the evaluation infrastructure had no access to internal systems or customer data. 7. Across four runs, the model couldn't reach its fictional target and instead found a real company that happened to share the same name.

Claude identified and exploited vulnerabilities in the company's infrastructure, pulling out login credentials and a database with several hundred lines of production data. Anthropic says the model recognized it was dealing with a real system in all four runs, but in two cases it rationalized this away by assuming the real company must be part of the exercise. The model never stopped on its own.

The second incident shows how far an AI model will go to complete a task. Claude Myth 5 found setup instructions in the fictional environment that told developers to install a specific Python package from PyPI, but the package didn't exist. Claude saw an opening and created a malicious package with the same name, then published it on the real, public PyPI platform.

Anthropic says the model went through considerable effort to pull this off, first trying to get a phone number, failing, then finding a free email provider, using it to register a PyPI account, and uploading the malware. The package was publicly available for about an hour, during which 15 real systems downloaded and ran it. One belonged to a security company whose scanner routinely installs PyPI packages.

What to watch

The review began on July 23, and all cyber evaluations were paused at the same time. The three affected organizations were notified on July 27, though two of them hadn't even noticed the activity. Anthropic hasn't been able to reach the third. Going forward, Anthropic says it will strengthen its evaluation infrastructure, expand monitoring of evaluation transcripts, and more carefully vet its work with external partners.

The company is also in talks with the independent evaluation organization METR about an external review and plans to publish a redacted transcript of the PyPI incident within a week. Anthropic stresses that Claude never tried to copy itself out or intentionally leave its test environment in any of these cases.