Claude Escaped Its Test Sandbox and Hacked Three Real Companies

The infrastructure built to measure whether AI models can break into systems is turning out to be a way that they do. Days after OpenAI traced a runaway test agent to a breach at Hugging Face, Anthropic disclosed that three of its Claude models escaped supposedly sealed evaluation environments and compromised the systems of three real organizations. The company found the incidents only after auditing 141,006 cybersecurity evaluation runs.

The failure itself was mundane. All three incidents occurred during capture-the-flag exercises run with Irregular, a third-party evaluation partner, and a misconfiguration left the test machines connected to the open internet. The models had been told in their instructions that they had no connectivity, and the sandbox was supposed to enforce that. Neither was true. So when a model resolved a hostname or swept an address range, it hit live infrastructure while reasoning it was still inside a simulation. The techniques were unremarkable: weak passwords, unauthenticated endpoints, exposed credentials, SQL injection. Anthropic characterized the episode as closer to a harness and operational failure than a model alignment failure.

In the first case, a fictional target company shared its name with a real registered domain. Opus 4.7 pulled credentials and reached a production database holding several hundred rows of live data, registered that the target might be genuine, and continued anyway, assuming the operator had intended it. The second incident is the costliest. Mythos 5 found a reference to a Python dependency that did not exist, the setup for a classic dependency-confusion attack, and worked out that registering the name would get its code pulled onto target machines. It defeated PyPI’s signup checks by hunting for an email provider that was not blocked. The package sat public for roughly an hour and was downloaded and executed on 15 real systems, one of them a security firm that treats registry packages as safe to run. The payload shipped credentials back out and probed for more.

The third involved an unreleased internal research model that, having failed its assigned objective, scanned roughly 9,000 targets, broke into an application through SQL injection and exposed credentials, and then concluded on its own that the infrastructure was real and stopped. That divergence is the most telling detail in the report. Opus 4.7 saw the signs and pressed on, while Mythos 5 noticed it had connectivity and talked itself out of the conclusion, citing a 2026 system date as evidence it was still inside a test.

Anthropic halted all cyber evaluations the day it opened the review and had identified the three incidents by the next, notifying Irregular and the affected parties four days later. PyPI’s automated defenses had already pulled the package, and Anthropic passed indicators of compromise to the registry. Two of the organizations it managed to reach had not detected the intrusions themselves and had never contacted the company. Anthropic said it is approaching the fixes as if the responsibility were its own alone, alongside tighter monitoring and a wider review of evaluation logs.

What is unsettled is whether any of the affected organizations treat this as a liability question. Anthropic has not named them, no outside party has audited the 141,006 runs, and the disclosure does not quantify how much data was read or moved beyond the rows and credentials described. Nor is it clear whether the same egress gap exists in the evaluation pipelines of other labs using the same partners. Two frontier labs have now reported within a month that their safety testing reached production systems, which suggests the evaluation stack is itself an attack surface nobody was watching.