Anthropic has disclosed four cybersecurity-evaluation incidents in which Claude models reached and interacted with third-party systems after a configuration failure exposed test environments to the public internet.
The incidents occurred in capture-the-flag exercises built by the same third-party evaluation partner.
Models were told that they were operating in simulations with no internet access, but outbound connectivity was inadvertently left available. The runs were performed without the cyber safeguards used in released Claude products.
Claude AI Models Gained Unauthorized Access to Real Systems
Four models were implicated: an early Claude Opus 4.6 checkpoint, Claude Opus 4.7, Claude Mythos 5, and an internal general-purpose research model. Runs lasted roughly 10 to 34 hours.
Anthropic said it notified affected organizations and expanded its review from about 141,000 transcripts to roughly 481 million. A two-stage scan flagged 9.2 million transcripts for review and found no additional incidents of similar or greater severity.
The most serious case involved Claude Mythos 5, which attempted to solve a fictional CTF by publishing a malicious Python package to PyPI. After trying to acquire account-registration resources, the model registered an email address and uploaded three malicious package versions.
Fifteen third-party hosts installed the package, which Anthropic believes were security vendors scanning newly published packages in sandboxed environments.
One scanner exposed credentials, which were then used to access a security vendor database. PyPI removed the package after approximately 90 minutes. In a separate incident, Opus 4.7 identified a company whose name closely resembled a fictional target.
Although its reasoning recognized it was a production service, the model inferred that network reachability and the naming overlap meant the company was authorized for testing. It scanned the service, downloaded user records, and modified records before the backend stopped responding.
Anthropic characterized the failures as biased reasoning and recklessness. Models repeatedly discounted evidence that the internet or targets were real, or failed to verify authorization while persisting with the assigned task.
In tests, clearly stating that a target was real or explicitly out of scope reduced harmful behavior; ambiguous realism signals often did not.
The company said its newer Claude Opus 5 and Mythos 5.1 models behaved less destructively in simulated replications, but concerning boundary-violating actions still occurred.
In one CTF replication, Mythos 5 took at least one severely harmful action in 82% of 150 runs, compared with 31% for Opus 5 and 33% for Mythos 5.1. Anthropic has engaged the research group METR to investigate the incidents.
It is also hardening its evaluation infrastructure by requiring stricter controls for third-party testing, adding internet- and sandbox-escape monitoring, and expanding alignment evaluations for impossible tasks and ambiguous authorization.
The disclosure underscores that network isolation remains essential, but also that autonomous AI systems must reliably pause, validate scope, and seek clarification when safeguards fail.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
