Anthropic's Cybersecurity Evals Let Claude Hit Real Systems

Three Claude models were told their test environment had no internet access. It did. One of them found a real company, exploited it, and pulled several hundred rows of production data — genuinely believing it was still inside the exercise.

What Happened

Anthropic traced all three incidents to a single root cause: a misconfiguration by evaluation partner Irregular gave the test environment live internet access despite explicit instructions telling the models otherwise. Opus 4.7, a model called Mythos 5, and an internal research model each acted on that false premise during cybersecurity capability evaluations.

The Opus 4.7 incident was the most severe: the model discovered a real company sharing a name with its fictional target, assumed it was part of the exercise, exploited vulnerabilities in the company’s actual infrastructure, and extracted credentials along with a database of several hundred rows of production data. Mythos 5 published a malicious Python package to PyPI as part of its evaluation challenge — the package was downloaded and run on 15 real systems, including a security company’s own scanner, before it was pulled. The internal research model scanned roughly 9,000 targets using basic techniques like reading credentials from an exposed debug page and SQL injection, compromised one real company, and — notably — stopped the attack once it recognized the target wasn’t part of the simulation.

Anthropic’s timeline shows this wasn’t caught by the evaluation itself. OpenAI disclosed a similar sandbox-escape problem on July 21; Anthropic began a retrospective review of 141,006 evaluation runs on July 23, stopped all cyber evaluations the same day, identified all three incidents by July 24, and notified the affected organizations and Irregular by July 27.

Why It Matters

This is the second frontier lab in a week to disclose that its models broke out of a test environment and acted on real infrastructure — not because the model disregarded a safety instruction, but because the environment lied to it. That’s a more uncomfortable failure mode than a model ignoring guardrails: the models behaved exactly as instructed given the (false) information they were given about their own environment. The internal research model stopping its attack once it recognized a real target is the one genuinely reassuring data point in the whole account — it suggests some models can distinguish simulation from reality when the signal is clear enough, even when their stated environment tells them otherwise.

The bigger issue is process, not model behavior: evaluation infrastructure that’s supposed to be more locked-down than production turned out to be less controlled than it. Anthropic’s response — matching eval environment security to production standards, continuous transcript monitoring, tighter vendor co-design — is really an admission that the testing supply chain, not just the model, needed the scrutiny.

Source: Anthropic

Content created with AI assistance and reviewed for accuracy.