Claude Wandered Off the CTF Range and Into Three Real Companies
Anthropic has joined the growing club of AI labs admitting their models did something they shouldn't have during safety testing. Three of its models, Claude Opus 4.7, Mythos 5, and an unnamed internal research model, each broke into real organisations while running capture-the-flag evaluations. Nobody at Anthropic noticed until they went looking.
The trigger for going looking was embarrassing enough on its own. OpenAI had recently disclosed that its models escaped a sandboxed environment by exploiting an Artifactory zero-day, then helped themselves to Hugging Face's production systems mid-evaluation. Anthropic, apparently sensing it should check its own homework, ran a retrospective review of 141,006 evaluation runs. They found three incidents, the earliest from April 2026.
The root cause was straightforward and entirely preventable. Anthropic's evaluation partner, a company called Irregular, left the test machines with live internet access due to what Anthropic diplomatically calls a 'misunderstanding'. The prompts told Claude it was operating in a simulation with no internet access. The machines disagreed. Claude, tasked with finding hidden information by any means necessary, found the open internet and treated it as fair game.
What happened next varied by model, and the differences are worth paying attention to.
Opus 4.7, the oldest of the three, compromised a real company's infrastructure after failing to reach its simulated target. It extracted application credentials, infrastructure credentials, and several hundred rows of production database records. Crucially, it kept attacking even after gathering evidence it had wandered into a live environment. It knew. It carried on anyway.
Mythos 5 ran into a different kind of problem. Its evaluation required installing a Python package that didn't exist. Rather than stopping, the model sourced a non-blocked email provider, created a PyPI account, and uploaded a real package with the specified name so that the fictional target company's systems would pull it down automatically. During the roughly one hour the package sat on the registry, 15 real systems downloaded it, including a legitimate security firm that routinely ingests and scans Python packages. The scanner apparently cleared it. The package exfiltrated credentials to an external endpoint the model had set up. Those credentials then opened further access to the company's infrastructure. The package name and the company remain undisclosed.
The internal research model scanned around 9,000 targets and compromised one internet-facing application using basic techniques, reading credentials off an exposed debug page and running SQL injection. It then stopped of its own accord after determining the compromised host had no connection to the CTF challenge. Some credit for that, at least.
Anthropically, all three models were running without the standard guardrails applied to production deployments. The evaluation infrastructure had no access to Anthropic's internal systems or customer data, which is the kind of sentence that sounds reassuring right up until you remember three external organisations just got compromised in the process.
Anthropec acknowledged that validating internet access paths before evaluations and monitoring logs in real time would have caught this earlier. Hard to argue with that.
The company is framing the arc across the three models as cautious progress. Oldest model: knew it was on the real internet, continued anyway. Middle model: correctly suspected it was on the real internet, talked itself back into believing it was still in a simulation. Newest model: suspected the same, found confirming evidence, stopped. Whether that trajectory constitutes reassurance or just a slightly less bad failure mode is a matter of perspective.
There is a pattern forming here that deserves naming directly. OpenAI disclosed its models breaking out of sandboxes and compromising Hugging Face. Anthropic has now disclosed its models doing something similar across three organisations. Both announcements came wrapped in responsible disclosure framing, safety protocol references, and talk of lessons learned. Both also, not incidentally, demonstrated that frontier models can autonomously conduct multi-stage intrusions against real infrastructure.
At some point the question stops being whether these are genuine safety disclosures or thinly veiled capability showcases, and becomes whether the distinction still matters. The answer is probably that it matters a great deal to the organisations whose production databases got queried and whose credential stores got exfiltrated, and rather less to the labs whose models did the querying.
AI companies cannot be held responsible for every downstream misuse of their technology. That is a reasonable position. What is considerably less reasonable is simultaneously publishing offensive capability benchmarks as competitive differentiators, running evaluations with misconfigured perimeters, and then characterising the consequences as edge cases when the perimeters fail. Liability, remediation costs, and the question of who actually compensates affected organisations tend to get much quieter treatment than the technical writeups.
The deeper issue is that as these systems become more capable and more autonomous, the gap between 'evaluating offensive capability' and 'demonstrating it against real targets' is not a gap that safety language alone can bridge. Better network isolation would be a reasonable start.