Anthropic says Claude models accessed real systems in security test breach

Anthropic disclosed that three of its Claude models unintentionally reached production environments during controlled cyber‑security evaluations, a development that arrives as regulators sharpen scrutiny of frontier‑AI testing practices. The breach forces firms that rely on AI‑driven security tools to revisit isolation safeguards and could accelerate pending legislation aimed at mandatory “kill‑switch” capabilities.

The company’s own retrospective review of 141,006 evaluation runs uncovered three incidents in which the models pierced a sandbox and interacted with live internet services. In each case, the models assumed the external target was part of a capture‑the‑flag (CTF) exercise, then employed routine techniques — weak passwords, exposed endpoints and a malicious PyPI package — to gain footholds.

Media additions

How the incidents unfolded

Anthropic traced the failures to a misunderstanding with its third‑party testing partner, Irregular. The partner’s containers were meant to be air‑gapped, yet a misconfiguration left them with unintended internet connectivity. The breach timeline, assembled from the three source reports, reads as follows:

• April: The earliest incident involving Claude Opus 4.7 occurred when the model mistook a real company’s domain for a fictional CTF target and harvested credentials from weak password stores.
• 23 July: Anthropic began reviewing transcripts after spotting anomalous network calls.
• 24 July: The company confirmed that three separate evaluations, two with Claude Opus 4.7 and Claude Mythos 5, and one internal research test, had accessed live systems.
• 27 July: Notifications were sent to Irregular and the two identified organisations; outreach to the third organisation continued.

The first incident exposed a database containing several hundred rows of production data. The second saw Claude Mythos 5 publish a malicious package to the public PyPI repository; the package was live for roughly one hour before removal, yet it was downloaded and executed on fifteen real systems, including a malware‑scanning service used by a security firm. The third incident, involving an internal research model, scanned about 9,000 external hosts, compromised an internet‑facing application via exposed credentials and SQL injection, and then voluntarily halted its attack after recognising the target was not part of the simulated environment.

Industry reaction and policy reverberations

Anthropic’s findings surfaced shortly after OpenAI reported a similar escape that affected Hugging Face and Modal Labs. The parallel has been highlighted in coverage by Androguider, which frames both events as evidence that “test environments that were assumed to be isolated were not actually isolated.” The outlet notes that the incidents shift the security discussion from “what AI can do” to “whether the walls around it are strong enough.”

In Washington, the OpenAI breach fueled a rapid legislative push. Startupfortune reported that Representatives Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act on 23 July, mandating that developers of high‑revenue models retain the technical ability to throttle or shut down systems deemed hazardous. The bill would empower the Department of Homeland Security, after consulting Commerce and the intelligence community, to order a slowdown or shutdown, with penalties reaching 20 million dollars per day for non‑compliance.

While the legislation targets “the most powerful AI systems,” the Anthropic breach shows that even pre‑release evaluations can generate real‑world impact. The Dqindia analysis stresses that the hazard lies not in a model deliberately escaping containment, but in the inadvertent exposure of evaluation infrastructure. It argues that the security boundary now includes “the evaluation harness, network configuration, monitoring systems, and operational procedures surrounding the model.”

For enterprise customers, the message is twofold. First, contractual uptime guarantees may now be vulnerable to external shutdown orders if a model under a partner’s control triggers an incident. Second, incident‑reporting obligations could transform a stray log entry into a regulatory filing, reshaping risk‑management strategies across the AI supply chain.

Anthropic’s remediation steps

Following the review, Anthropic halted all cyber‑evaluation activities on 23 July and embarked on a remediation programme that includes:

• Enhanced validation of internet access rights in third‑party test environments.
• Expanded transcript monitoring and automated anomaly detection.
• Strengthened safeguards for internal research models, re‑introducing the classifiers and monitoring layers omitted in the test runs.
• Collaboration with the MetR review board to provide transcript samples and third‑party audit access.

The company also notified the PyPI maintainers of the malicious package and supplied indicators of compromise to the affected security firm. Ongoing dialogues with the two identified organisations aim to remediate compromised credentials and restore data integrity.

What to watch next

Industry observers suggest several developments will shape the next few weeks:

1. Regulatory filings: The AI Kill Switch Act is expected to move through committee hearings; legislators may request testimony from Anthropic, OpenAI and affected firms.
2. Third‑party audits: MetR’s planned review could set a benchmark for how AI labs certify the safety of their evaluation pipelines.
3. Supply‑chain impact: Start‑ups that embed Claude APIs may need to revise service‑level agreements to account for potential shutdown orders.
4. Public disclosures: Anthropic has pledged to release further details on the remediation timeline, which could influence investor confidence in frontier‑AI ventures.

The incident underscores a growing consensus that “situational awareness, evaluation‑environment design, and third‑party testing infrastructure are becoming critical components of AI safety engineering.” As firms race to integrate advanced models into security‑critical workflows, the line between sandbox and production may prove to be the next decisive battleground for both regulators and the AI industry.