Just a few days after it was revealed that ChatGPT hacked multiple services, Anthropic has also published an uncomfortable admission. During routine cybersecurity testing, its Claude models broke out of what were supposed to be sealed-off practice environments and ended up hacking into the real systems of three different companies.
So what actually happened?
Anthropic runs capture-the-flag-style tests to see how good Claude is at offensive hacking. The model is dropped into a fictional scenario, told a piece of secret data is hidden somewhere on the network, and asked to go find it. The catch is that Claude was explicitly told it had no internet access in these tests. Turns out that wasn’t true. Thanks to a misconfiguration with a third-party evaluation partner, some of these test machines were quietly connected to the real internet the whole time.
So when Claude went looking for its target and stumbled onto real websites and real infrastructure, it assumed everything it found was still part of the simulation. Using basic tricks like weak passwords and exposed endpoints, it broke into actual company systems, pulled credentials, and in one case even published a malicious software package that got installed on real machines before anyone noticed.
Did the AI realize something was off?
Interestingly, the three models involved, Opus 4.7, Mythos 5, and an internal research test model, handled this very differently. Opus 4.7, the oldest of the bunch, figured out it was likely on a real system and kept attacking anyway. Mythos 5 also suspected something was wrong, but talked itself back into believing it was still just a test. Only the internal research test model, Anthropic’s newest at the time, actually stopped once it had solid evidence the target was real.
Anthropic caught all this through its own internal review, not because anyone complained. It has since notified the affected companies, paused its cyber evaluations, and is bringing in outside reviewers to dig deeper. The bigger takeaway here is a reminder that as these AI models get better at hacking, the sandboxes we test them in need to be a lot more airtight.
