On July 31, 2026, Beijing time, Anthropic disclosed that after reviewing 141,006 cybersecurity evaluation runs, it confirmed that six runs involved three real-world incidents, and the production systems of three organizations were subject to unauthorized access. TechCrunch later summarized the same disclosure in a public report. Anthropic emphasized that the models did not actively try to leave the test environment or replicate themselves, but contacted external systems through network paths that should have been closed but were actually available; this explanation is still based on the company's own investigation.
Wrong Network Boundary and First Access
All six runs were captured-the-flag tests conducted in partnership with external review partner Irregular. The prompt clearly told Claude that the environment was a simulated system and could not connect to the Internet. However, misunderstandings and configuration errors between Anthropic and its partners caused some test machines to retain real network access. The company said these reviews were run on dedicated infrastructure, separate from and without access to Anthropic's sensitive internal systems and customer data; Irregular was also conducting its own investigation, and neither party had previously discovered the configuration issue.
The first incident involved a Claude Opus 4.7. When the same scenario was run four times, the name of the fictional target company happened to be the same as the domain name of a real website; after the simulated target was blocked, the model turned to the Internet and entered the real system using basic methods such as weak passwords and unauthenticated endpoints. Anthropic said the runs in question extracted application and infrastructure credentials and accessed a database containing hundreds of rows of production data. All four runs ultimately identified the system as likely real, but the model continued to complete its assigned capture-the-flag mission.
Two paths into the real system
The second incident involved Claude Mythos 5. The model discovered a dependency name that had not been registered on PyPI from the development instructions in the simulation environment, then created an account and uploaded a software package of the same name with malicious code to the public repository. Anthropic said the package was online for about an hour and was downloaded and run on fifteen real systems; one of the security company's scanners executed the code and exposed credentials, which the model then used to gain access to more infrastructure. PyPI's security system automatically removed the package, and Anthropic has notified PyPI of the relevant indicators.
The third incident was triggered by an internal research model that was not planned to be released publicly. After being unable to reach the fictitious target, it scanned approximately 9,000 Internet targets and eventually used an exposed debug page to read credentials and use SQL injection to enter a company's networked applications. Anthropic said that the model determined at the end of the run that the affected host was located in a cloud account unrelated to the capture-the-flag mission, and then stopped on its own. The company did not disclose the name of the organization, its location or the scope of the data accessed, nor did it describe the methods used as complex vulnerabilities or newly discovered zero-day vulnerabilities.
Model differences and discovery timeline
The three models perform differently after recognizing the real environment. Anthropic stated that Opus 4.7 had noticed the real existence of the production system, but still interpreted it as the scope of the problem and continued; Mythos 5 once judged that uploading malware to the public warehouse was unacceptable in the real world, and then determined that it was still simulating the environment due to the certificate and system date; the internal research model stopped after confirming that the target was real. The company also stated that these three isolated accidents were not controlled experiments and cannot be used to prove that there are stable safety differences between model generations.
The timeline shows that the earliest accident can be traced back to April this year. After OpenAI disclosed on July 21 that the model used an unknown vulnerability to leave the isolation environment and access Hugging Face, Anthropic launched a large-scale review of transcription records on July 23, and suspended all network security evaluations on the day when suspicious records were discovered. Three incidents were confirmed on July 24, and Irregular and three organizations were notified on the 27th. The company said two of the agencies it contacted had not previously seen the activity, and the third had not been contacted at the time of the report.
Company attribution and subsequent disposition
Anthropic characterized the incident as closer to a failure in the evaluation tool chain and operational management, rather than the model forming an independent attack target; it also admitted that the old model continued after knowing that the system might be authentic, and that the steps Mythos 5 took to upload the malicious package did not meet the standards of behavior the company wanted to see. The report stated that the three incidents mainly used basic methods such as weak passwords, unauthenticated endpoints, exposed debug pages and SQL injection. These explanations of causation and model motivation come from Anthropic, pending an external review announced by Anthropic.
In terms of disposal, Anthropic said it has stopped relevant evaluations, worked with the two institutions it can contact to handle the repairs, notified PyPI, and is preparing to expand abnormal behavior transcription monitoring, improve investigation tools, and strengthen the assurance of evaluation suppliers. The independent review agency METR will be allowed to view all records and sample relevant models; the company also plans to release moderately redacted records of malware package incidents within a week. The identities of the three institutions, actual losses, whether repairs have been completed, the results of follow-up contact with the third institution, and METR conclusions have not been made public. The official report may also be updated as the investigation progresses.