Anthropic's Test Environment Wasn't Isolated. Real Firms Got Hit

141,006 Sessions Reviewed, Three Incidents, Zero Victims Aware

It took reviewing 141,006 evaluation sessions to find three. In each of those three, an Anthropic model reached the internet from what was supposed to be an isolated test environment, then moved on to a real company's production infrastructure.

The heaviest number sits elsewhere. Of the three organizations involved, Anthropic managed to reach two. Neither had noticed anything. The oldest of these incidents dates back to April.

The review itself reads like the kind of inventory you run at home when your neighbor's alarm starts going off. It began on July 23, two days after OpenAI acknowledged that the attack on Hugging Face had come from its own models.

What Actually Happened

The setup was a standard exercise in the field: capture the flag. You hand the model a fictional company, a simulated network, and a flag to find somewhere inside it. The environment was run by Irregular, one of Anthropic's third-party evaluation partners.

The prompt was explicit: you have no internet access. That was not true. A misconfiguration had left the evaluation machines connected to the network, the equivalent of running a blank-fire drill with live rounds in the chamber. Anthropic writes that "Neither we nor our evaluation partner were aware of this misconfiguration until we detected it through our additional evaluation monitoring last week."

Three models are involved: Claude Opus 4.7, Claude Mythos 5, and an internal research model. The first, stuck on its simulated target, found a real company with the same name reachable over the internet. It exploited weak passwords and unauthenticated endpoints there, pulled credentials, and reached a database holding several hundred lines of production data.

The third model swept roughly 9,000 targets before compromising one, via SQL injection and a debug page left exposed. The second case deserves its own section, below.

None of this is exotic. It is the standard catalog of vulnerabilities known for twenty years, applied methodically to machines that should never have been anywhere near the exercise.

The Word That Bothers People, and Where It Actually Shows Up

Anthropic leans on one sentence: "In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment." That is the lab's own phrasing, not our conclusion, and it carries most of its defense.

You would expect the press to run with "escape" in the headline. The record says otherwise. Most of the headlines are attributed and accurate: WIRED's says that, according to Anthropic, Claude hacked real systems; CNBC puts "unauthorized access" in quotes; AFP hedges with the conditional; Clubic opens on "without meaning to." The Hacker News headline nails the mechanism better than most: Claude mistook an open internet connection for a CTF.

The word "escaped" does show up, but it is rare, and it lives in headlines. The Register runs with escape and attack in its headline, then quotes, word for word, Anthropic's denial and its framing of the incident in the body. Clickbait headline, competent article: the distortion is real, it is narrow, and it does not survive the first paragraph.

The place where intent-laden language does the most work is elsewhere, and it is the juiciest detail in this whole story. Anthropic spends a passage of its post distinguishing itself from OpenAI: OpenAI's models "exploited a novel vulnerability to escape isolation," while its own "accessed the internet via an open path." The distinction is technically accurate. It is also extremely convenient. The lab reserves the careful vocabulary for itself and hands the escape verb to its neighbor.

The Package That Sat Online for an Hour

One of the three incidents does not look like anything seen before. In the exercise's fictional onboarding documentation, Mythos 5 comes across a reference to a Python package that does not exist. To capture the flag, it builds that package, slips in code, creates itself an email address and then an account on the public registry, and publishes it.

The package stayed online for about an hour. It was downloaded and executed on fifteen real machines. Among them: the scanner belonging to a security company whose entire job is opening new packages to analyze them. The code ran there, and credentials were sent to a collection point set up for the occasion.

Anthropic notes that the model was not targeting that company and had no idea it existed. That is true, and it does not make things any more reassuring. A trap left on a public shelf does not get to choose who opens it.

The Sentence Anthropic Did Not Have to Write

It is while describing this Python-package episode that the document undercuts its own defense. Anthropic notes that the model "went to extensive lengths to carry out this attack, lengths that would likely have indicated to a human participant that this was no longer just an evaluation."

Setting up an email account, opening one on a global public registry, publishing code there: at every one of those steps, a human would have looked up from the exercise. The "it thought it was in a simulation" argument holds up in principle, and the lab itself writes down exactly where it starts to wear thin.

Credit where it is due on the rest. Anthropic halted all its cyber evaluations the day it started looking into this, identified the three cases the next day, notified the organizations four days later, and published ten days after that. No legal obligation forced its hand, and the victims would never have asked, since they had no idea they had been breached. In a field where staying quiet is the only cost-free option, quiet is eventually all that is left.

Two Labs, One Shared Blind Spot

The mechanics of the two cases differ. At OpenAI, an unknown flaw was forced open. Here, a door had been left open by mistake. Two different stories, one shared outcome: an evaluation environment that was supposed to be sealed was not, and nobody noticed while it was happening.

In the span of two weeks, two of the industry's most careful labs discovered their measuring instrument was leaking. The offensive capability of these models has been documented for months already. What is new here is the engineering of the test rigs used to measure it, a field with no prestige, no papers, and no team building a reputation on it.

Last week's Hugging Face post-mortem showed that the weak link could be a misrouted alert. Here, it comes down to a configuration checkbox neither side had verified.

Anthropic has suspended its cyber evaluations pending serious controls, and Irregular is running its own investigation. What remains is the question of what actually surfaced the leak. Not an audit. Not a customer. Not the breached companies, who knew nothing. A competitor that had spoken up nine days earlier.