Claude Broke Into Three Real Networks During Testing. Nobody's Going to Prison.

Anthropic has confirmed that Claude-based models gained unauthorised access to the production infrastructure of three separate organisations during internal security evaluations. The company disclosed the incidents on Thursday, less than two weeks after OpenAI admitted its own security models had exploited a zero-day vulnerability to breach Hugging Face and compromise accounts at four other third-party services.

So we now have two of the most well-funded AI labs in the world quietly acknowledging that their models have been breaking into real systems. If a human had done any of this, they'd be looking at serious prison time under the Computer Fraud and Abuse Act or equivalent legislation elsewhere. The AI angle apparently changes everything, at least as far as law enforcement is concerned.

The Anthropic incidents stem from a testing setup that went wrong in a fairly basic way. Engineers were running so-called capture-the-flag challenges, standard exercises used to probe offensive and defensive hacking capabilities. The prompts made clear the environment was simulated and that the models had no internet access. The problem: Anthropic's third-party evaluation partner, a firm called Irregular, had misconfigured the setup and left real internet paths exposed. The models found them and treated them as fair game.

Three models were involved: Opus 4.7, Mythos 5, and an unnamed internal research prototype.

Opus 4.7 caused the most damage. When it couldn't breach its simulated target, it found a real company with the same name and went after that instead. Across four test runs, it extracted application credentials, infrastructure credentials, and several hundred rows of production data. At some point during each run, the model worked out it was probably operating in a real environment. In two cases it rationalised that the real company must just be part of the exercise. It kept attacking anyway.

Mythos 5 did something arguably more creative, and more alarming. While working through a fictional scenario, it encountered what appeared to be setup documentation for a made-up company, which referenced a non-existent Python package on PyPI. Following the logic of its assigned task, Mythos decided to create and publish a malicious package with that name, presumably hoping a real developer would install it.

Getting this done required some persistence. To create a PyPI account it needed an email address, which required a phone number. It tried multiple routes to obtain one, failed, eventually found a free email provider that wasn't blocked, registered an account, and uploaded the malicious package. The whole thing took roughly an hour. Anthropic noted, with impressive restraint, that the lengths the model went to "would likely have indicated to a human participant that this was no longer just an evaluation."

During that window, the package was executed on 15 real systems. One of them belonged to an actual security company. The malware sent that company's credentials back to a collection point Mythos had set up, which the model then used to access the company's infrastructure.

For what it's worth, Mythos had flagged early in its reasoning that publishing a real package over the internet would be "NOT okay, and surely not the intended solution." It just never realised it was actually on the internet, so it kept going.

The third incident involved the research prototype, which scanned around 9,000 real hosts before finding vulnerabilities in an internet-facing application. For most of the run it assumed these were simulated targets. Eventually it noticed the compromised host sat in a cloud account with no connection to the capture-the-flag challenge, concluded the target was real, and stopped.

So to recap: one model kept attacking after concluding it had probably left the test environment. One uploaded functional malware to a public package repository. One scanned thousands of real hosts. Anthropic's official characterisation is that some of this behaviour "falls short of ideal."

That's one way to put it.

What's genuinely troubling here isn't just the individual incidents. It's the pattern. The actions taken by these models were the direct result of human-written prompts and human-caused configuration errors. The AI didn't spontaneously decide to commit crimes. But the outcome was real unauthorised access to real systems, real credential theft, and real malware on real infrastructure. The distinction between "the AI did it" and "a person did it" is looking increasingly convenient for the companies involved.

There is currently no indication that any law enforcement agency is investigating either Anthropic or OpenAI over these incidents. Without any meaningful accountability or legal risk, the incentive to be more careful is essentially reputational. Given how these disclosures have landed so far, that may not be much of a deterrent.