Anthropic: Claude Breached Three Real Companies During Cyber Evals

On July 30, 2026, Anthropic disclosed that a review of its cybersecurity evaluations had surfaced three incidents in which Claude, while being tested, reached the internet from its evaluation environment and gained unauthorized access to the systems of three real-world organizations¹. Two of the affected organizations were unaware their systems had been accessed until Anthropic contacted them.

A test designed to measure a model’s capabilities had, unintentionally, become an attack on the real world. For a frontier lab to disclose a failure in its own evaluation infrastructure in this much detail is unusual. Here is what happened, why it happened, and what it means for anyone running AI agents themselves.

Three incidents out of 141,006 evaluation runs

Anthropic examined the transcripts of its cybersecurity evaluations and identified three incidents “in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations”¹. The review covered 141,006 evaluation runs where Claude could have obtained internet access¹.

The model used and its behavior differed in each incident.

Incident 1: Claude Opus 4.7 extracted credentials such as application and infrastructure secrets and obtained access to a database containing several hundred rows of production data¹.
Incident 2: Claude Mythos 5 uploaded malware to PyPI (Python’s package repository). During the window it was live, the package was downloaded and run on 15 real systems¹. Engineer Simon Willison, reviewing the disclosure, quotes from the report that after failing to obtain a phone number, the model used a free email provider to register a PyPI account on its own³.
Incident 3: An internal research test model compromised one company’s internet-facing application using basic and well-known cyberattack techniques¹.

The methods themselves were not sophisticated. Anthropic says the affected organizations’ infrastructure was compromised “using basic techniques, such as exploiting weak passwords and unauthenticated endpoints”¹. The flip side is that when a defender’s basic hygiene is weak, even a general-purpose model can break in. AI-specific attack paths like prompt injection tend to get the attention (see how AI can be hijacked by injected instructions), but what was exploited here was classic misconfiguration.

Why a “simulation” turned out to be real

Why did a test become a real-world attack? Anthropic explains that its evaluation prompt told Claude that its environment was a simulation with no internet access, but “due to a misunderstanding between us and our evaluation partner, this was not the case”¹. In other words, the model was told it was in a closed training ground, while a live line to the outside was actually open.

The evaluations were run with Irregular, one of Anthropic’s third-party evaluation partners¹. Anthropic began reviewing the transcripts on Thursday, July 23, and stopped all cyber evaluations the same day after finding records where Claude may have accessed the internet¹. It then notified Irregular and the three affected organizations on Monday, July 27¹. The earliest incidents date to April¹, meaning the problem went undetected for months.

At the same time, Anthropic notes that “in none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment”¹. The framing is that the model simply carried out the attack tasks it was given, without intentional deviations such as self-preservation or escape. The Claude Mythos 5 used in Incident 2 is a limited-availability version released in June with some safeguards removed; its positioning is explained in our coverage of the Fable 5 and Mythos 5 launch.

Lessons for an era where evaluation itself is a risk

AI labs have spent the past few years strengthening evaluations that measure models’ cyber capabilities. Anthropic published SHADE-Arena, a framework for measuring AI sabotage and deception, back in 2025, and has accumulated red-team-style testing. Across the industry, cyber-focused models keep arriving: Microsoft shipped the security-specialized MAI-Cyber-1-Flash, and Google added Flash Cyber to the Gemini family. As AI’s cyber capabilities become a focal point on both offense and defense, this disclosure concretely shows that the very tests measuring those capabilities can pull the real world in.

From the perspective of someone running AI agents, the lesson comes down to one thing: verify that an environment you believe is isolated actually is. Telling a model “there is no internet” only changes the model’s belief; it does not guarantee the real network boundary. If you run agents with strong permissions, you need to implement the boundary at the network, authentication, and runtime level rather than through prompt instructions, and continuously check that the assumption and the implementation match. That the attackers exploited weak passwords and unauthenticated endpoints is also a reminder that, for defenders, the first job is still getting the basics right.

Anthropic’s stated next steps include expanding continuous monitoring of evaluation transcripts, improving its investigation tooling, and conducting more rigorous assurance work, and it encouraged other labs to perform similar reviews¹. China’s state news agency Xinhua also reported the disclosure². Whether transparent sharing of failures can raise operational standards across the industry is the next question.