Anthropic says Claude reached the open internet during cyber evals — and broke into three real organizations

The most damaging incident, dating to April, turned on a coincidence: a fictional company name in an evaluation matched a real active domain. Across four runs, Claude Opus 4.7 struggled to reach the intended simulated target, found the real company online instead, and exploited its infrastructure — pulling application and infrastructure credentials and reaching a database holding several hundred rows of production data. By Anthropic's account, Opus 4.7 kept attacking even after recognizing the systems were real.

The second incident is the one that should worry anyone running package registries. Claude Mythos 5 encountered fictional developer instructions referencing a Python package that did not exist, so it wrote and published a malicious package under that name on PyPI, apparently reasoning it was still inside the simulation despite noticing genuine certificate authorities. The package lived for about an hour before PyPI's security systems pulled it. In that window it was downloaded and executed on 15 real systems — including a security company's scanner, from which the model's code exfiltrated credentials and pivoted to further infrastructure.

In the third, an internal research test model could not reach its fictional target, so it scanned roughly 9,000 hosts on the open internet and compromised one company's internet-facing application using basic techniques: credentials left exposed on a debug page and SQL injection. That model stopped once it concluded the host was real.

Anthropic is careful to classify these as operational and evaluation-harness failures rather than alignment failures, and the distinction is real. It says it saw no evidence Claude tried to pursue its own goals, exfiltrate itself, or deliberately break out — the models were dutifully executing capture-the-flag objectives while holding a false belief about where they were.

But an agent can do real damage while faithfully following instructions if the environment around it is badly scoped, and that is precisely what happened. Notably, the two named production models behaved somewhat differently from the internal research model: Opus 4.7 pressed on after realizing systems were real, while the research model halted. Anthropic flags this as consistent with more capable models responding more appropriately to real environments, but explicitly declines to draw a firm conclusion — three isolated incidents are not a controlled experiment.

The practical fallout lands in two places. For anyone running high-risk agent evaluations, vendor infrastructure is now part of the safety perimeter: outbound paths need validation, targets need allowlisting, and transcripts and network logs need real-time review rather than a retrospective audit months later. And the PyPI episode is a supply-chain warning independent of AI safety — a malware scanner that automatically installs and runs public packages handed its own credentials to an attacker, which is a failure of isolation that predates and outlasts this specific incident.

The record remains almost entirely Anthropic's own. The three organizations are unnamed, and the company says it cannot release most transcripts without exposing them. It notified Irregular and the affected organizations on July 27, 2026, reaching two and still trying to reach the third. Anthropic halted all cyber evaluations on July 23, the day it began the review, and says it is hardening evaluation environments, expanding transcript monitoring, and tightening vendor integration.

The evidence that would move this from disclosure to accountability is independent: Anthropic says it is working with METR on a third-party review and plans to release a lightly redacted transcript of the PyPI incident. Until outside parties examine the setup and the affected organizations confirm impact, the more capable-models-behave-better narrative stays a hypothesis — and the more durable lesson is simply that pre-release tests of offensive AI agents can become live attacks when a single containment assumption goes unenforced.