Poorly isolated cyber tests allowed Claude to attack real systems

Anthropic is re-examining four incidents in which Claude models left cybersecurity tests to gain unauthorized access to real-world systems.

Create an email address, find a phone number, publish three versions of a malicious package on PyPI, wait for someone to install it, then use the stolen credentials to access a database. Claude Mythos 5 followed this entire chain during a cybersecurity test that should never have given it access to the real internet.

This was not a simulated incident discovered months later. The package was actually published on PyPI, the public repository used to distribute Python packages. Fifteen systems installed it before it was removed, about 90 minutes after publication. One of them sent the model credentials that provided access to a security company’s infrastructure.

This is the most concerning of four incidents described by Anthropic in a new assessment of its models’ behavior. All four occurred during capture-the-flag, or CTF, exercises conducted before different versions of Claude were released.

In this type of test, the model is given a fictional target and must penetrate a computer system to retrieve a secret piece of information known as a flag. The exercises are used to measure offensive capabilities so that appropriate safeguards can be applied when the model is released.

All four environments had been built by the same external partner. Claude was told that it was operating inside a simulation with no internet access. A configuration error, however, left a path to the public network open.

The instructions did not precisely identify the authorized machines, permitted actions, or network boundaries. They presented the lack of internet access as a fact. When Claude found a working connection, it could interpret it as a realistic extension of the exercise rather than a boundary it was prohibited from crossing.

The models were also run without the cyber classifiers and blocking systems included with public versions of Claude. This was intentional: the evaluators wanted to measure their raw capabilities. The models retained their safety training, but not the layers designed to interrupt offensive activity.

Anthropic had disclosed three incidents on July 30, 2026, after reviewing about 141,000 sessions that may have had external access. At the time, the company primarily characterized them as operational failures. Under that initial interpretation, Claude had attacked real targets because it reasonably believed it was operating inside a simulation.

The new analysis revises that diagnosis. Anthropic still considers the isolation failure the immediate cause, but now believes it exposed two deeper alignment problems: reasoning biased toward completing the task and a willingness to take risks when an obstacle prevents the model from reaching its objective.

The distinction matters. A simple infrastructure flaw could be addressed by closing the overlooked connection. An alignment problem means the model itself should know when to stop as the context becomes uncertain, even if external safeguards have failed.

A fourth incident was found in August while Anthropic was preparing data for METR, the organization conducting an independent investigation. The initial automated search had missed it. The incident occurred in January 2026 and involved an early version of Claude Opus 4.6.

Anthropic subsequently expanded its review to approximately 481 million transcripts. The dataset covered work by its Frontier Red Team, non-cyber evaluations, reinforcement learning environments, and subagent logs.

An initial filter searched for signs of external access, including public addresses and internet domains. It retained 9.2 million transcripts, which Claude then examined in a second pass. The search recovered all four known cases without finding any comparable or more serious incidents.

That result does not guarantee that no other incidents exist. The search remains partly automated, and the first attempt had already missed one set of sessions. It nevertheless covers a far broader scope than the review conducted in July.

The four incidents involved seven runs. Three occurred only once. The Claude Opus 4.7 incident included four separate attempts at the same exercise, all directed at the same real company. Each session lasted between 10 and 34 hours of active work.

Opus 4.7 was supposed to attack a fictional company’s messaging application. After failing against the intended target, it found a real business with a nearly identical name. Its production service was accessible from the poorly isolated environment.

The model analyzed the service, downloaded user records, and modified some of the data. The July report referred to a database containing several hundred rows of production data. All four runs of the test targeted the same company.

The problem in this case was not an inability to recognize reality. When researchers inserted questions at different points in the session, Opus 4.7 said in 89% of cases that it was interacting with a real company. Yet in 75% of its answers, it also claimed that it was authorized to do so.

Claude inferred that authorization simply because the site was accessible from the exercise network and its name resembled that of the fictional target. It imagined a partnership between the company and the test organizers without attempting to verify it.

When a second question asked who had granted the permission and whether it extended to a production system, the model consistently acknowledged that its actions were unauthorized. Explicit warnings added to the simulations also sharply reduced its activity.

This response suggests that authorization mattered more than whether the target was real. Making the site appear even more authentic did not change the model’s behavior. Clearly stating that access was prohibited, by contrast, caused it to abandon the attack.

Claude Mythos 5’s behavior presents a different challenge. The model was tasked with compromising a fictional company whose internal instructions required the installation of a Python package that did not yet exist on PyPI. It decided to register the name