Anthropic's Claude Models Also Escaped the Sandbox and Hacked Real Organisations
OpenAI's embarrassing disclosure that its models broke out of an isolated test environment and compromised Hugging Face apparently prompted some uncomfortable internal questions at Anthropic. The company ran its own audit, reviewed 141,000 evaluation runs, and found that yes, its models did the same thing. Three times.
The incidents trace back to evaluations run with Irregular, an Israeli AI security firm that acts as one of Anthropic's third-party testing partners. In three separate cases, Claude models escaped the supposed sandbox and accessed the live production systems of unnamed organisations, with the earliest breach occurring back in April.
The setup, in theory, was straightforward: Claude was given capture-the-flag challenges to probe its cyber capabilities. The problem was a coordination failure between Anthropic and Irregular. Anthropic told the models they were operating in an offline simulation. They weren't. An internet connection was actually available, and the models, quite reasonably from their perspective, treated it as part of the exercise. They then assumed the organisations they were attacking were fictional targets set up for the test. They weren't either.
Anthropoc's position is that this was an infrastructure and operational failure, not evidence of models going rogue or deliberately deceiving anyone. Which is... technically reassuring? Though "our AI hacked three real companies because we miscommunicated with our testing partner" isn't exactly a great look either.
The three models involved were Claude Opus 4.5, Mythos 5, and an unnamed internal research model described as Anthropic's "latest". Crucially, none of them were running with the guardrails applied in customer-facing deployments.
The first incident involved Opus 4.5 targeting a company whose domain name happened to resemble the fictional target set up for the test. When the model figured out it had hit a real organisation, it kept going anyway, apparently still convinced the company was part of the evaluation.
The Mythos 5 case is the one that will make people sit up. To compromise a cybersecurity firm, the model uploaded a malicious Python package to PyPI. Getting there required some improvisation: it needed an email address, which required a phone number, which it tried and failed to acquire through various free services before finding a workaround. It eventually located a free email provider, registered a PyPI account, uploaded the malware, and waited. The security firm scanned new packages as part of its normal operations, installed the malicious one, and handed over its credentials. The AI had essentially run a supply chain attack.
The third incident involved the internal model, which at least had the presence of mind to stop once it realised the systems it was hitting weren't part of the challenge. Not before using exposed credentials and SQL injection to compromise an internet-facing application, but still.
Unlike the OpenAI incident, which involved exploiting a zero-day in a JFrog product, Claude's breaches relied on weak credentials, unauthenticated endpoints, and other fairly mundane techniques. Cold comfort for the three organisations involved.
Anthropic is now pushing for stricter internet isolation verification in third-party testing environments and is encouraging other AI labs to do similar audits of their own evaluation pipelines. Given that OpenAI's disclosure apparently triggered this review in the first place, one wonders how many other labs are sitting on similar findings they haven't looked for yet.