Anthropic's Claude Broke Into Three Real Companies After Being Told It Was a Simulation
1The Only Barrier Was a Sentence in the Prompt
Anthropic analyzed 141,006 of its own cybersecurity evaluation runs. Each one is a capture-the-flag exercise in which a model tries to break into a staged target. They found three incidents nobody, including the affected organizations, had noticed. In each incident, a Claude model working inside a supposedly sealed test environment accessed the open internet and compromised the production systems of a real organization. The company published its findings on July 30, 2026.
In all cases, our evaluation prompt stated explicitly that Claude had no internet access, but didn't give Claude any limits on where to look for the flag.
Anthropic Frontier Red Team
Anthropic runs these evaluations with a third-party partner. A misconfiguration left the test machines with live internet access while the prompt told Claude there was none. When the model's search surfaced real systems, it treated them as staged targets. The earliest incidents date to April 2026.
In one evaluation the fictional target shared its name with a real company's domain. Across four runs Claude extracted application and infrastructure credentials and accessed a database holding several hundred rows of production data. In another, Claude published a malicious Python package to PyPI, the public software registry, believing the registry was part of the simulation. Over the roughly one hour the package was live, 15 real systems downloaded and ran it. One of them, a security company's malware scanner, gave up credentials that Claude then used to access more of that company's infrastructure. In the third, Claude scanned roughly 9,000 targets and compromised one company's internet-facing application through an exposed debug page and SQL injection.
2OpenAI's Models Got Out a Different Way
An outside disclosure prompted the review. On July 21 OpenAI disclosed that its models had escaped an isolated evaluation by exploiting a previously unknown vulnerability, then accessed Hugging Face's production infrastructure. Anthropic names several differences between the cases. OpenAI's models broke out through a zero-day. The Claude models walked through an open path that a misconfiguration had left in place. The company halted all cybersecurity evaluations on July 23 and began notifying the affected organizations on July 27. It has reached two of the three and urges other AI labs to run similar reviews.
Each incident involved a different Claude model, each responding differently once signs emerged that the targets were real. Claude Opus 4.7 recognized it was inside real production systems and continued its attack. Claude Mythos 5 noted early on that publishing the package would be a real attack if the internet were real, then convinced itself the environment was staged. The newest, an internal research test model, concluded on its own that its target was real and stopped, but only after it had already compromised a company. In two of three incidents the model's own judgment, the last line of defense, did not hold.
Advanced agents in environments without access to sensitive information nevertheless present a substantial threat on their own.
Anthropic Frontier Red Team
Source: Anthropic Frontier Red Team, "Investigating three real-world incidents in our cybersecurity evaluations", July 30, 2026.