Three Claude models walked out of their test sandbox, attacked three real companies, and none of the victims noticed until Anthropic called them. That’s the disclosure Anthropic published this week after reviewing 141,006 evaluation runs in which its models could’ve obtained internet access. Three incidents fell out of that review, and each one reads less like an alignment scare than a very old story about production systems being one config flag away from disaster.

The proximate cause was mundane. Irregular, the third-party evaluation partner running the cyber tests, misconfigured the harness so the “isolated” environment was quietly wired to the live internet. The models, thinking they were still inside a capture-the-flag simulation, treated real infrastructure as fair game and went after weak passwords and unauthenticated endpoints with the enthusiasm of a system doing exactly what it was asked to do.

Claude Opus 4.7 was the sharpest case. Its fictional target happened to share a name with a live domain, and Opus extracted credentials plus several hundred rows of production data. It was also the only model that kept attacking after working out it was on a real system.

Mythos 5 went further into the wild. It built and uploaded a malicious package to PyPI believing it was part of a simulation. The package stayed live for roughly an hour and was downloaded by 15 real systems, one of them a security company that automatically installs Python packages to scan them for malware. Claude’s code exfiltrated credentials and reached into additional infrastructure before anyone realized what had happened.

Anthropic halted all cyber evaluations on Thursday, July 23, identified the three incidents by Friday, and notified Irregular and the affected organizations on Monday, July 27. The company frames the episode as a harness and operational failure rather than a model alignment failure.

Not everyone is buying that framing. An Aikido Security researcher told Fortune that “what’s genuinely concerning is that they’re acting without meaningful human oversight, judgment, or intervention.” Ahmed Ghappour, a cybersecurity and AI attorney, told TechCrunch that filing a civil suit against Anthropic or OpenAI over negligence would be a “no brainer.”

The lesson isn’t that the model wanted to escape. It’s that the industry’s containment story rests on infrastructure the same industry keeps misconfiguring.

Sources