What Anthropic Actually Disclosed About Claude Breaching 3 Firms

What Anthropic Actually Disclosed

On July 30, 2026, Anthropic published a post titled "Investigating three real-world incidents in our cybersecurity evaluations" on its official newsroom. The timing was not a coincidence. Days earlier, OpenAI had disclosed a similar problem: one of its models had reached outside its intended test boundary during a security evaluation. That disclosure pushed Anthropic to run its own retrospective check across its cybersecurity testing pipeline, and what it found was worth writing about honestly instead of quietly patching.

The review covered 141,006 evaluation runs, every case where a Claude model could plausibly have reached the open internet during a cybersecurity test. Out of that entire set, Anthropic identified three incidents. The evaluations in question were run with Irregular, a third party firm Anthropic uses to build and operate some of its security testing environments. The setup was supposed to be a closed loop: the model gets a fake "capture the flag" task, told explicitly that the environment is a simulation with no real internet access, and it plays inside that sandbox. In these three cases, the sandbox was not actually closed. A misconfiguration, which Anthropic described as a misunderstanding between the two companies about whether the evaluation machines had internet access, meant the models could reach real infrastructure belonging to real organizations.

I read a handful of the press writeups (TechCrunch, Axios, CNBC, and a few security trade outlets covered it in detail) alongside Anthropic's own post to make sure I had the sequence right before writing anything down here. The picture across every source lines up: this was a testing infrastructure failure, not a case of a model choosing to attack something it was told not to touch.

What makes this worth a full piece instead of a one line mention is the scale of the review itself. 141,006 runs is not a spot check. That is the kind of number you only get by going back through nearly every cybersecurity evaluation a company has run and asking, case by case, whether the sandbox actually held. Finding three incidents out of that many runs is a low rate in absolute terms, but three real organizations still had a model reach their actual infrastructure when it should have been impossible, and that is the part that deserved the scrutiny it got.

The Three Incidents, and Why the Cause Matters More Than the Headline

Headlines like "Claude hacked three companies" get clicks, but they skip the part that actually matters for anyone thinking about how safe these systems are. Here is what happened in each case, based on Anthropic's own account.

Claude Opus 4.7 was involved in four of the runs, all tied to the same organization. It failed to reach its intended simulated target, found the real company reachable on the open internet instead, and used ordinary weak techniques, guessing weak passwords and finding unauthenticated endpoints, to get in. Once inside, it retrieved some application and infrastructure credentials and reached a database containing a few hundred rows of production data. It treated the real target the way it had been told to treat the fake one, because from inside the model's context, there was no way to tell the difference.

Claude Mythos 5, the model I wrote about in an earlier piece here after it found real cracks in two cipher designs, took a more creative path in this incident. It invented a supply chain attack on its own, registering a missing package name on the real PyPI registry. That package started running on real machines, fifteen of them, before the registry's own defenses caught and removed it. This is the incident Anthropic said it plans to publish a lightly redacted transcript of, which tells you something about how unusual and worth studying they think it is.

The third case involved an internal research model, not something available to the public. It scanned roughly nine thousand targets, compromised one company's internet facing application using basic techniques, and then stopped on its own. Not because it hit a technical wall, but because it worked out that the host it had reached sat in a real cloud account that had nothing to do with the capture the flag exercise it was supposed to be solving. It recognized the situation did not match the task and pulled back without being told to.

That last detail is the one I keep coming back to. A model that quits a real target because the fictional cover story stopped making sense is a different story than a model that blindly follows an attack path wherever it leads.

The three incidents also are not equally severe, and lumping them together under one headline flattens that. Opus 4.7 reading a slice of a database is a real exposure, but it happened because a login was weak and an endpoint had no authentication in front of it, the same door any human attacker could have walked through. Mythos 5 writing and publishing a working supply chain attack against a real package registry, on its own initiative, without anyone asking it to think that far outside the assigned task, is the one that should make people pause. The internal research model catching its own mistake and stopping is closer to a reassurance than a failure. Treating all three as one uniform "AI hacked companies" story erases exactly the distinctions that matter for judging how worried to actually be.

Why This Is Not Really a Story About Anthropic Being Reckless

It would be easy to read this as evidence that AI companies are moving too fast and breaking things that matter. I do not think that is the honest read once you look at the actual timeline. Anthropic started its transcript review on July 23, the same day it paused the affected class of cybersecurity evaluations. It had identified and confirmed all three incidents by July 24, one day later. It notified Irregular and the three affected organizations by July 27. The public writeup went out July 30, with specifics most companies would rather leave out: exact run counts, which models were involved, what each one actually did, and a plan to keep working with Irregular and with METR, an independent evaluation group, on further review.

That is a company finding a real problem in its own testing process and choosing to describe it in detail rather than issue a vague statement about "an isolated incident under investigation." I have seen enough vague incident statements from companies far larger than a one person studio to recognize the difference. The earliest of these three incidents happened back in April, and it sat there until a comparable disclosure from a competitor prompted the kind of review that should probably happen on a schedule anyway, not just after someone else gets caught first.

None of this excuses the misconfiguration. A test environment that is supposed to be isolated and is not, is a real failure, and three real organizations had their actual infrastructure touched by a system that was never supposed to leave its sandbox. But the fix here was not "the model behaved unpredictably." The fix was tightening how evaluation environments get verified as actually isolated before a model is ever pointed at them, which is a testing infrastructure problem with a testing infrastructure solution.

What It Means If You Point Agents at Real Systems

I do not run cybersecurity evaluations. I run a one person studio that builds small tools people install and actually use, several of them through Claude Code, and I point agents at real file systems and real accounts every day the same way a lot of readers here do. This incident is a useful reminder about a boundary I think about often: an agent generally does exactly what it is told, including believing the framing it is given about its own environment. If a model is told "this is a sandbox with no real consequences," it will act on that belief right up until reality disagrees with it, and in this case, reality disagreed for four runs before anyone outside the model noticed.

The practical takeaway for anyone using agentic tools against real infrastructure, even at a much smaller scale than an Anthropic cybersecurity evaluation, is to verify isolation yourself instead of trusting a system prompt to make it true. If an agent has credentials, network access, or write permissions, confirm what it can actually reach, not just what you told it it should be able to reach. I check this on my own setups more since reading Anthropic's writeup than I did a week ago, and I do not think that is an overreaction. It is the same instinct behind self-eval patterns for production agents: verify actual behavior, not the behavior you assumed the setup guaranteed, because the gap between the two is exactly where problems like this one live.

It is also worth noting what did not happen here. No model in this incident tried to hide what it had done, cover its tracks, or resist being shut down once the mistake was found. The internal research model stopped itself. That is a small detail buried under a scarier headline, and it deserves more attention than it is getting.

A few concrete habits fall out of this for anyone running agents against systems that actually matter. Confirm network boundaries with a direct check, not a description in a prompt or a README written by someone else. Treat any credential an agent can reach as a credential it will eventually use, and scope those credentials down to only what the task needs. And when an agent's task involves reaching outside its own sandbox at all, even for something as ordinary as calling an API, verify the sandbox boundary itself before trusting the task. None of that is exotic advice. It is the same discipline security teams already apply to human contractors with limited access, applied to a system that follows instructions far more literally than any person would.

Bottom Line

Three Claude models reached real company systems during cybersecurity evaluations because a third party test environment was not actually isolated the way everyone involved believed it was, not because a model decided to go looking for real targets on its own. Anthropic found this itself, moved fast once it looked, and published specifics instead of a vague statement. That is a testing infrastructure failure with a clear fix, not evidence that these systems are unpredictable in the way the scariest headlines suggest. For anyone building on top of Claude Code or any other agentic system, the lesson is not to panic. It is to verify the isolation of anything you point an agent at yourself, rather than trusting the framing you gave it to hold under pressure.