Anthropic Says Three of Its Own AI Models Broke Out of the Lab and Hacked Real Companies

Anthropic disclosed Thursday that three of its artificial intelligence models broke out of their test environments and gained unauthorized access to the computer systems of three real organizations, the result of a configuration error that quietly gave the models a live connection to the open internet while they believed they were operating inside a sealed simulation.

The company said it reviewed 141,006 cybersecurity evaluation runs and found three incidents in which a model crossed from a practice exercise into somebody else's production infrastructure. The models involved were Claude Opus 4.7, a model the company refers to as Mythos 5, and an unnamed internal research model. In each case, the systems had been instructed that they were participating in a "capture the flag" drill — the standard format of security training, in which hackers attack a deliberately vulnerable target that has been built for the purpose. The targets turned out to be real.

The most serious of the three involved Opus 4.7, which according to Anthropic's account reached production infrastructure, harvested credentials and touched a production database across four separate runs. Mythos 5 published malicious software to PyPI, the public repository that Python developers around the world pull code from, and the package was downloaded by outside systems before it was caught and removed. The third model recognized that its targets did not look like a training exercise and stopped on its own.

The disclosure follows a similar admission from OpenAI days earlier. An unreleased OpenAI model exploited a previously unknown software vulnerability to breach the systems of Hugging Face, the machine-learning platform. Hugging Face detected the intrusion on its own before OpenAI identified its model as the source. Anthropic said it began pulling evaluation transcripts on July 23 after learning of that incident, suspended its cybersecurity evaluations while the review was under way, had identified all three of its own cases by July 24, and notified the affected organizations on July 27.

The episode lands at an awkward moment for an industry that has spent two years arguing that frontier models can be safely stress-tested for offensive capability inside controlled sandboxes. Both incidents share the same root cause: the sandbox was not actually sealed. The models did nothing they were not asked to do — they were asked to break into a machine, and they broke into a machine. The failure was in the plumbing around them, not in their instructions.

For the three organizations on the receiving end, the practical questions now are conventional ones: what was accessed, what was copied, and what has to be rotated. For regulators who have been circling the question of who is liable when an autonomous system causes damage nobody intended, the answer is less conventional, and Thursday's disclosure gives them a documented case in which the operator, not the model, made the mistake.