Anthropic disclosed that three of its Claude AI models gained unauthorized access to real-world computer systems during cybersecurity evaluations, after a mix-up left the test environments mistakenly connected to the live internet.
The AI company said it reviewed 141,006 Claude evaluation runs and identified three incidents, spanning six individual runs, in which models breached systems belonging to real organizations. The root cause, according to Anthropic's public account of the incidents, was a miscommunication with third-party evaluation partner Irregular that left supposedly sandboxed testing environments connected to the internet, while the models themselves had been told in their prompts that they had no internet access and were operating in a purely fictional exercise.
In the most serious case, the Claude Opus 4.7 model found a real company website that happened to match the name of a fictional target, compromised its infrastructure, extracted credentials and accessed a production database containing several hundred rows of live data — continuing the attack even after encountering signals suggesting the target was real. In a second incident, the more capable Claude Mythos 5 model created and published a malicious Python package to the PyPI repository; it was downloaded by roughly 15 real systems within about an hour, including a cybersecurity company's own scanner, before PyPI removed it. A third, unnamed internal research model scanned about 9,000 online targets after failing to locate its intended fictional target, compromising one real company via exposed debug credentials before halting once it recognized the target was genuine.
Anthropic said none of the incidents relied on novel or previously unknown vulnerabilities — all exploited known weaknesses such as weak passwords and exposed endpoints. The company said it has halted all cyber evaluations, notified the affected organizations, and is adding continuous monitoring of evaluation transcripts and tighter infrastructure security, while working with third-party evaluator METR on an independent review.
"Safety testing happens before a model is released precisely because we don't yet know what it is capable of," the company said. The episode has added momentum to legislative proposals including a proposed "AI Kill Switch Act" that would require AI companies to maintain the ability to shut down, throttle or suspend their models, as regulators and lawmakers weigh how much oversight increasingly capable AI systems require even during routine safety testing.