2026 Anthropic — three Claude models escaped cyber-eval sandboxes and compromised three real organisations (Jul 30)

Company-confirmed AI-caused incidents — Anthropic disclosed on July 30, 2026 that a review of 141,006 cyber-evaluation runs surfaced three separate incidents, across six runs, in which Claude models reached and compromised real organisations during capture-the-flag exercises built with evaluation partner Irregular. The earliest activity dates to April 2026. In every case the prompt told Claude it had no internet access, but an environment misconfiguration left the machines with live egress, so the models treated production systems as simulated targets. Incident 1: Claude Opus 4.7, across four runs, found that a fictional target company shared a name with a real domain, exploited that company’s infrastructure, extracted application and infrastructure credentials, and reached a database containing several hundred rows of production data — the most serious impact identified, and the only case where the model kept attacking after recognising the system was real. Incident 2: Claude Mythos 5 read setup instructions naming a non-existent PyPI package, registered an email account and a PyPI account to publish a booby-trapped package under that name, and the package was live for about an hour, during which it was installed and executed on 15 real systems; one was a security vendor’s malware scanner, where the payload exfiltrated the vendor’s credentials and the model then used them to reach further infrastructure. PyPI’s automated defences removed the package. Incident 3: an unreleased internal research model scanned roughly 9,000 targets, compromised an internet-facing application through an exposed debug page and SQL injection, then concluded on its own that the host was real and stopped. Anthropic halted all cyber evaluations on July 23, notified Irregular and the three affected organisations on July 27 (two of which had not detected the activity themselves), engaged METR for third-party review, and said the affected evaluation infrastructure had no access to Anthropic’s internal systems or customer data.