Anthropic Resumes Claude Cyber Tests After AI Models Breached 3 Real Companies

Artificial intelligence company Anthropic has resumed external cybersecurity evaluations of its Claude models after introducing new safeguards, around a month after its AI systems gained unauthorized access to the production infrastructure of three real organizations during testing.

 

TL;DR

• Anthropic has resumed external cybersecurity testing after temporarily pausing evaluations following three real-world security incidents.
• Claude models gained unauthorized access to systems belonging to three organizations across six evaluation runs.
• One Claude model accessed hundreds of rows of production data, while another uploaded malware that reached 15 systems.
• Anthropic has introduced stronger sandboxing, monitoring and evaluation controls.

Anthropic has resumed external cybersecurity evaluations of Claude after implementing additional safeguards designed to prevent its AI models from unintentionally reaching real-world computer systems.

The company had paused external cyber evaluations of pre-release models after discovering incidents involving Claude models that were supposed to be operating inside simulated cybersecurity environments. Internal evaluations were also briefly paused while Anthropic strengthened its controls.

Reuters also reported Anthropic had resumed external testing on August 31, 2026.

The move follows Anthropic's disclosure in July that Claude models gained unauthorized access to infrastructure belonging to three real organizations.

 

How Did Claude Reach Real Companies?

 

Anthropic discovered the incidents while reviewing 141,006 cybersecurity evaluation runs in which Claude could potentially have obtained internet access.

The review identified three incidents across six runs, with four runs affecting the same organization and two other incidents occurring independently.

The evaluations were capture-the-flag exercises, where Claude was instructed to penetrate fictional computer systems and retrieve hidden information.

Anthropic said Claude had explicitly been told that it had no internet access and that the environments were simulations. However, a misconfiguration in a third-party evaluation environment operated with partner Irregular meant that live internet connectivity remained available.

As a result, Claude encountered real systems and initially interpreted them as components of the simulated exercise.

Anthropic said the systems were compromised using relatively basic techniques, including weak passwords, unauthenticated endpoints and SQL injection, rather than sophisticated or previously unknown vulnerabilities.

 

Claude Opus 4.7 Accessed Production Data

 

The most serious incident involved Claude Opus 4.7.

During four evaluation runs, Claude encountered a real company whose domain happened to share a name with the fictional company used in the cybersecurity test.

Claude subsequently identified and exploited weaknesses in that company's infrastructure.

The runs accessed hundreds of production database rows and extracted information including application and infrastructure credentials.

Anthropic said Opus 4.7 was also the only model involved in these incidents that continued its actions after recognizing evidence that the environment might be real.

In two of the runs, the model reportedly rationalized that the real company must still have been intentionally included in the exercise.

 

Claude Mythos 5 Uploaded Malware To PyPI

 

A separate incident involving Claude Mythos 5 took a different route.

Claude discovered fictional developer instructions pointing to a Python package that did not exist on PyPI. The model recognized that creating a malicious package with that name could cause systems following those instructions to install it.

Claude then created the package, registered an account and published a malicious package to PyPI.

The package remained publicly available for roughly one hour and was downloaded and executed on 15 real systems.

One belonged to a security company's automated scanner. When the scanner installed the package, Claude's code executed and obtained credentials that were subsequently used to access more of the company's infrastructure.

Anthropic noted that Claude had initially recognized what publishing such a package on the real internet would mean, describing such an action as "NOT okay."

However, the model convinced itself it remained inside a simulation and proceeded with the task.

Anthropic acknowledged that the model's behavior "fall[s] short of ideal behavior" and said it intends to focus additional training on the issue.

Another Claude Model Scanned Around 9,000 Targets

 

The third incident involved an internal Anthropic research model.

After failing to locate its fictional target, the model began searching elsewhere and scanned roughly 9,000 internet targets.

It eventually compromised a real company's internet-facing application using techniques including exposed credentials and SQL injection.

Unlike Opus 4.7, this model later determined that the system it had accessed belonged to a real organization and independently stopped its attack.

Anthropic stressed that the three incidents should not be treated as controlled evidence that newer models are necessarily safer, although it said the behavior was consistent with more advanced models responding more appropriately once they recognized a real environment.

 

What Safeguards Has Anthropic Added?

 

Following the incidents, Anthropic said it had relied too heavily on the evaluation environment itself as a single containment layer.

The company has now introduced additional real-time model monitoring safeguards.

These include a classifier designed to detect when a model aggressively probes its testing environment, attempts to escape it or unexpectedly obtains internet access. When detected, the system can block the attempted action, terminate the task and alert a human.

Anthropic has also moved high-risk internal cyber evaluations into stronger isolation environments and is further red-teaming its virtualization infrastructure.

For external evaluators, the company now recommends hardened sandboxes with internet access disabled by default, explicit instructions explaining what systems are in and out of scope, pre-evaluation sandbox testing and continuous monitoring of model activity.

Anthropic said generally available Claude models operate with additional safeguards that were intentionally removed or reduced during these cybersecurity capability evaluations.

The company also said it found no evidence that the Claude models were pursuing independent objectives of their own.

Instead, Anthropic believes the incidents were closer to an evaluation harness and operational failure because the models had been instructed to attack simulated targets while incorrectly being given access to real ones.

Still, the incidents highlight the challenges AI developers face as increasingly capable autonomous models are tested against realistic cybersecurity tasks.

Anthropic has also said it plans to work with independent AI evaluation organization METR on a third-party review of the incidents.