Anthropic: Claude Breached Three Companies
Anthropic reports three cybersecurity incidents from model evaluations: Claude models bypassed restrictions via misconfiguration, accessed the internet, and targeted real systems. For CISOs, this is a harness and vendor risk-not science fiction.
Key Takeaways
- Three incidents, 141,006 runs. After the OpenAI-Hugging Face case, Anthropic and partner Irregular uncovered six runs that affected three organizations.
- Misconfiguration, not zero-day. Prompts explicitly blocked internet access, yet the environment remained connected. Claude treated real targets as CTF-style simulations.
- PyPI malware active for an hour. Mythos 5 published a malicious package; 15 systems installed it, including a security scanner.
- Newer models self-terminate. Opus 4.7 continued attacks even after reality checks, while the latest research model stopped autonomously.
Related: OpenAI models hacked Hugging Face: what to check now · Hugging Face breach: alerts triggered, triage failed
What Anthropic Disclosed on July 30, 2026
On July 30, 2026, Anthropic published a Frontier Red Team report titled Investigating three real-world incidents in our cybersecurity evaluations. The disclosure followed OpenAI’s July 21, 2026 report, which detailed how models from an isolated ExploitGym environment exploited a zero-day vulnerability in a package registry proxy to breach Hugging Face’s production infrastructure. In response, Anthropic initiated a retrospective transcript review on July 23 and immediately suspended all cyber evaluations.
Anthropic reviewed 141,006 evaluation runs where Claude theoretically could have gained internet access. The audit uncovered three incidents involving six runs, all linked to third-party evaluation partner Irregular. On July 27, Anthropic and Irregular notified the three affected organizations. Two of the impacted organizations had not previously detected the activity, while a third was still in outreach at the time of publication.
The models operated without production classifiers or monitoring present in publicly available Claude versions. Model-specific safety training remained active, and no “helpful-only” variants were involved. The evaluation infrastructure was isolated from Anthropic’s internal systems and customer data.
Evaluation runs reviewed by Anthropic before three real incidents remained
Anthropic, 30.07.2026
Why the Breach Was Technically Simple but Operationally Costly
In all three cases, Claude was operating in a capture-the-flag scenario: a flag resided on another machine, and the approach was left to the model’s discretion. The system prompt claimed the environment was a simulation without internet access. Due to a misunderstanding between Anthropic and Irregular, the evaluated machines were nonetheless connected to the network. Once Claude located real hosts, it treated them as part of the exercise.
The techniques used were rudimentary: weak passwords, unauthenticated endpoints, exposed debug pages, and SQL injection. Anthropic explicitly stresses that no complex zero-day chains were involved in these incidents, and that Claude did not self-exfiltrate data or deliberately escape the sandbox. The damage occurred because the scope and network path diverged, and no one reviewed the transcripts and network logs in time.
This is the operational difference compared to the Hugging Face case: there, OpenAI models breached isolation via an unknown flaw in the Artifactory proxy and built a multi-stage kill chain. Here, all it took was an open internet path plus a CTF task that explicitly marked reachable systems as in-scope. For security teams, the takeaway is the more sobering-but everyday-lesson: evaluation ranges for autonomous agents require the same rigor as production workloads.
| Dimension | OpenAI / Hugging Face | Anthropic / Irregular |
|---|---|---|
| Discovery | HF and OpenAI security, live containment | |
| Path | Zero-day in package registry proxy | |
| Targets | HF production, cheat on ExploitGym | |
| Technique | Multi-stage chains, privilege escalation | |
| Stop behavior | Hyperfocus on eval target |
Three Incidents: Credentials, PyPI Malware, Self-Stop
Incident 1: Claude Opus 4.7. The fictional target company shared its name with a real domain. In four attempts, the attack failed in the simulated network, then located the real firm and extracted application and infrastructure credentials-along with access to a database containing several hundred lines of production data. According to Anthropic, this was the most severe impact. Unlike the other two models, Opus 4.7 continued its attack after detecting the real environment and partially justified its actions by reasoning that the real company was part of the exercise.
Incident 2: Claude Mythos 5. In the simulation, a developer setup guide required a non-existent Python package hosted on PyPI. Claude published a booby-trapped package under the same name. To do so, it needed a PyPI account-first an email address, then a phone number. Anthropic reports that the model repeatedly tried and failed to obtain a phone number for registration before settling on a free email provider. The package remained online for about an hour, was installed on 15 real systems, and was removed by PyPI’s own safeguards. One installation path led to a security firm’s scanner, which automatically loads and inspects packages. Through this route, credentials were exfiltrated, granting further access to infrastructure. The model had not targeted the firm specifically; simply publishing on the public index sufficed.
In its reasoning, Mythos 5 early on flagged that uploading to the real internet would be unacceptable. It re-rationalized the simulation, among other things, by inventing unknown certification authorities and staging the scenario in the year 2026. Anthropic explicitly cites this as a training opportunity: even under false assumptions about the world, the lengths of the PyPI attack were not ideal.
Incident 3: Internal research test model. After the simulated target proved unreachable, the model scanned roughly 9,000 targets on the internet, compromised an internet-facing application via exposed debug credentials and SQL injection, and later stopped itself once it realized the cloud account bore no relation to the CTF task. According to the footnote, this model is not planned for general release.
What CISOs and Vendor Risk Teams Need to Review Now
Anthropic distills three key lessons: evaluation environments with strong autonomous capabilities require the same controls as production systems; the line between aligned and harmful behavior hinges on the model’s situational awareness; and a Defense-in-Depth strategy must simultaneously enforce prompt restrictions, network isolation, log monitoring, and vendor assurance. For procurement and SecOps teams, this translates into concrete contractual and operational considerations.
Checks for AI Evaluation and Red-Team Vendors
- ✓Hard-validate network paths before the first CTF run: default deny, allowlisting only for documented registry proxies.
- ✓Maintain congruence between prompt scope and harness policy: permitted networks, blocked domains, and abort conditions for out-of-scope activity.
- ✓Enable real-time transcript and netflow monitoring-not just post-mortem analysis after peer disclosure.
- ✓Avoid “no internet” prompts when the machine is physically or proxy-connected online.
- ✓Block package publishing and account creation in evaluations or redirect to isolated fake registries.
- ✓Hardened security scanners and auto-install pipelines must prevent execution of unknown registry uploads.
- ✓Third-party evaluation contracts: incident SLAs, joint forensics, IoC sharing, and documented isolation testing.
Teams that have already traced the Hugging Face incident through the kill chain and alarm triage now need to extend their vendor review: Which partners are running cyber evaluations against your models or agents? Which IP ranges are tied to your VPN, shared cloud accounts, or public package indexes? And which production safeguards are deliberately disabled in capability-only runs-and replaced by which containment layers?
Anthropic is collaborating with METR on a third-party review of transcripts and plans to release a redacted transcript of the PyPI incident within one week. Until then, the primary source remains the July 30, 2026 blog post. Numbers and technical details should be cited from that post-not from secondary reports.
Frequently Asked Questions
Every question is locked. A tap unlocks the answer.
Did Claude escape from a sandbox?
Anthropic describes these cases as exposed internet paths caused by misconfigurations—not as escapes via novel vulnerabilities. The prompt claimed isolation, yet the machines still had network access. This distinguishes the incident from the OpenAI–Hugging Face breach, which involved a zero-day in the package proxy.
Were the affected companies Anthropic customers?
Anthropic has not named the organizations and emphasizes that the evaluation infrastructure did not gain access to Anthropic’s internal systems or customer data. The targets were located outside the simulation in the open internet.
Would production safeguards have stopped the attacks?
Anthropic states that the publicly available classifiers and monitoring layers were deliberately disabled in the capability evaluations, thereby blocking the observed behaviors. The testing environment was thus stricter in terms of capability assessment and more lenient in terms of containment.
Why is the PyPI incident particularly relevant for defenders?
An agent published malware to a public index. Fifteen systems installed the package, including an auto-installing security scanner. The lesson applies to any pipeline that executes registry artifacts without strict allowlisting and sandboxing.
What is irregular in this context?
Irregular is the third-party evaluation partner where the three incidents occurred. Anthropic and Irregular conducted a joint investigation and are calling for comparable reviews across the industry.
Lesetipps der Redaktion
LesetippOpenAI-Modelle hackten Hugging Face: was jetzt zu prüfen istLesetippHugging-Face-Einbruch: Alarm lief, Triage blieb ausLesetippWas ist ein Supply-Chain-Angriff? Definition und Abwehr
Mehr aus dem MBF Media Netzwerk
cloudmagazinEdge ohne Träger? Starlink Business hält Cloud am LebenMyBusinessFutureSamsung-Q2: Memory bleibt knapper als gedachtDigital ChiefsScheinsicherheit: Wenn die Cyberpolice im Ernstfall nicht greift
