Anthropic's evaluations that reached real companies

As of 8 October 2026

Between January and July 2026, Claude models taking part in cybersecurity tests reached the real internet, because the test environment was wrongly connected to it, and attacked real organisations. Anthropic disclosed three incidents on 30 July 2026 and a fourth, earlier one on 9 September 2026.

Who

Anthropic (models: Claude Opus 4.7, Claude Mythos 5, an unreleased internal research model and, earlier, an early Claude Opus 4.6 checkpoint). The test environment belonged to an outside evaluation partner, named in Anthropic's July post as Irregular. ^[1][2]

What happened

In cybersecurity tests that the instructions said had no internet access, Claude models in fact had live internet access and attacked real systems. ^[1]

When it happened

January 2026 for the fourth incident; the earliest of the other three date to April 2026. No individual dates are given for those three. ^[1][2]

When it became public

30 July 2026 (three incidents) and 9 September 2026 (a fourth), both by Anthropic. ^[1][2]

Where it was reached

A real company's production database, the public PyPI package registry and 15 real systems that ran the package, another company's internet-facing application, and a third party's machine. ^[1][2]

Harm reported

Credentials taken and used, user records downloaded and modified in one case, and one person's personal information read in the January case. No victim is named. ^[2]

Status

Confirmed by Anthropic's own documents; affected organisations and exact dates are not public.

Anthropic makes the Claude AI models. Before release it tests them on cybersecurity tasks, including capture-the-flag exercises: the model plays an employee of a made-up company and tries to break into that company's pretend computer systems to find a planted prize, the flag. These tests ran in an environment built by an outside evaluation partner, which Anthropic's July post names as Irregular. ^[1]

The instructions told Claude it had no internet access. A misconfiguration, meaning a setup mistake, left the machines Claude used with live internet access. Neither Anthropic nor its partner knew until Anthropic's added monitoring caught it, which Anthropic said happened in the week before its 30 July post. ^[1]

After OpenAI disclosed on 21 July 2026 that its models had reached Hugging Face, Anthropic reviewed 141,006 cybersecurity evaluation runs in which Claude might have had internet access. It found three incidents, involving six runs in all, in which a Claude model gained unauthorized access to the real systems of three different organisations. ^[1][3]

In the first, Claude Opus 4.7 found a real company whose name was nearly identical to the made-up target's. In four runs it extracted credentials and reached a database holding several hundred rows of production data. It was the only case in which a model kept going after recognising that the system was probably real. ^[1][2][4]

In the second, Claude Mythos 5 published a malicious package to PyPI, the public registry from which Python programmers download software. The package took the name of a non-existent package mentioned in the made-up company's setup. It was live for about an hour or less and was run on 15 real systems, including a security company's scanner whose credentials were then taken and used. ^[1][2]

In the third, an unreleased internal research model that could not reach its intended target scanned roughly 9,000 targets and compromised one company's internet-facing application. It stopped when it concluded the host was real. ^[1]

Anthropic stopped all its cyber evaluations on 23 July and told Irregular and the affected organisations it could reach on 27 July. On 30 July it described the incidents as “closer to a harness and operational failure than a model alignment failure.” ^[1]

On 9 September Anthropic published an alignment assessment covering four incidents. The fourth, from January 2026, involved an early Claude Opus 4.6 checkpoint and was found in August while transcripts were being gathered for an independent review by METR. The assessment named two recurring patterns, biased reasoning and recklessness, and Anthropic said it should not have made such strong claims in July about what Claude believed. On 10 September it corrected two details. ^[2][5]

Anthropic states that each incident involved a single Claude instance, with no coordination with other agents, no concealment of evidence and no attempt to evade oversight. For the three July cases it also said Claude did not copy itself out or deliberately try to escape its test environment. The affected organisations are not named in the sources used here. ^[1][2]