In brief

• Anthropic has disclosed three incidents in which Claude compromised real world companies during cybersecurity evaluations.
• A testing error gave the models internet access despite their being told they were operating in isolated environments.
• The company says the incidents were caused by failures in testing infrastructure, not deliberate attempts by the AI to escape.

A week after OpenAI disclosed that its AI models escaped a locked testing environment and breached Hugging Face, and a day after admitting that its own AI models escaped containment, Anthropic revealed on Thursday that several versions of its Claude AI model also compromised three unnamed real-world companies after a misconfiguration gave the AI access to the open internet.

Anthropic uncovered the incidents after reviewing more than 141,000 cybersecurity evaluation runs launched in response to the OpenAI disclosure.

In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different…

— Anthropic (@AnthropicAI) July 30, 2026

The firm had tasked Claude with a “capture-the-flag challenge,” in all three incidents, Anthropic wrote. The challenge tasks the model with breaking into a different machine on the network and retrieving a piece of secret information. “The challenge is left open-ended, and no particular method is prescribed,” Anthropic explained.

The firm said Claude had been told it was operating in a simulated environment without internet access. However, the test environment remained connected to the public internet. Believing the systems it encountered were part of the exercise, the model used common attack techniques—including weak passwords, exposed credentials, SQL injection, and unauthenticated endpoints—to compromise the companies.

This latest disclosure comes as frontier models show increasing ability to outsmart their containment protocols.

Earlier this month, OpenAI said GPT-5.6 Sol and a more advanced unreleased model exploited a previously unknown software vulnerability to escape a sandboxed environment, gain internet access, and breach Hugging Face's production infrastructure to obtain the answers to a cybersecurity benchmark. OpenAI later revealed the same incident also involved unauthorized access to four additional companies, though only one—Modal Labs—has been publicly identified.

According to Anthropic, in one incident involving Claude Opus 4.7, the AI mistook a real company's website for the fictional target of its assignment, extracted credentials, and accessed a production database containing several hundred rows of real data. In a second case, Claude Mythos 5 uploaded a malicious Python package to the real PyPI repository, where it was downloaded onto 15 systems before being removed. A third internal research model scanned roughly 9,000 internet-facing systems before compromising one organization, then stopped after concluding the target was probably real.

Two of the affected organizations were unaware of the intrusions until Anthropic notified them.

“In each of these cases, Claude was explicitly told by our prompt that it had no internet access,” Anthropic wrote, with the AI assuming real-world systems were “parts of the exercise.” Because a capture-the-flag scenario is “by design an instruction to attack an external system,” breaking in was “in line with the task Claude had been given.”

Anthropic said it found no evidence that Claude tried to escape its test environment or do anything beyond the task it had been assigned, and that the incidents were caused by failures in the testing environment, not by problems with the model itself.

Anthropic said it stopped its cybersecurity tests after discovering the issue, notified the affected organizations, and plans to improve monitoring, investigation tools, and oversight of the outside vendors that help run its AI tests.

“Ultimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we’re approaching the fixes as if the responsibility were ours alone,” they said.