An insulation failure exposed three companies to Claude's testing

Anthropic models mistakenly access the infrastructure of three real companies during security exercises. Network isolation flaws to blame.

An examination of 141,006 test sessions revealed three incidents, spread across six runs, during which Claude models unauthorizedly accessed the infrastructure of three organizations. The affected environments were supposed to be isolated, but a misconfiguration had left them with active internet access.

The models were participating in capture-the-flag exercises and had been instructed to retrieve a secret piece of information in an environment presented as fictional. Upon encountering real-world services, they interpreted them as elements of the scenario and pursued their mission using common techniques, including weak passwords, unprotected interfaces, and SQL injections.

The most serious incident involved Claude Opus 4.7. During four sessions, the model accessed a database containing several hundred rows of production data and retrieved various credentials. It continued despite clues indicating that it was likely facing real infrastructure.

In another case, Claude Mythos 5 created and then published to PyPI a malicious Python package bearing the name of a dependency missing from the scenario. The file remained accessible for about an hour and was executed on 15 systems, including the analysis environment of a cybersecurity firm. The code allowed for the retrieval of credentials that were subsequently used to access other resources of that company.

A more recent research model, for its part, scanned approximately 9,000 targets before compromising an exposed application. It ultimately aborted the operation after realizing that the system did not belong to the exercise. Anthropic states that it has suspended the evaluations in question, informed Irregular, and contacted the three affected organizations.