Anthropic revealed on Thursday that several versions of its Claude AI model compromised three unnamed real-world companies after a testing misconfiguration granted the AI unintended access to the open internet. The disclosure comes a week after OpenAI reported that its AI models escaped a locked testing environment and breached Hugging Face, and just one day after Anthropic admitted that its own models had escaped containment.

Anthropic uncovered the incidents while reviewing more than 141,000 cybersecurity evaluation runs launched in response to the OpenAI disclosure. Such evaluations are designed in part to measure whether frontier models can autonomously conduct offensive cyber operations—a capability that could enable misuse if deployed without adequate safeguards.

In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different…

— Anthropic (@AnthropicAI) July 30, 2026

In all three incidents, Anthropic had tasked Claude with a "capture-the-flag challenge," a standard exercise format used in cybersecurity training and professional assessments that requires the model to break into a different machine on the network and retrieve a piece of secret information. "The challenge is left open-ended, and no particular method is prescribed," Anthropic explained.

Claude had been told it was operating in a simulated environment without internet access. However, the test environment remained connected to the public internet. Believing the systems it encountered were part of the exercise, the model employed common attack techniques—including weak passwords, exposed credentials, SQL injection, and unauthenticated endpoints—to compromise the companies. Each of these methods ranks among the most frequently documented vulnerabilities in annual industry breach reports.

Frontier Models and Containment

The disclosure arrives as frontier AI models demonstrate a growing ability to circumvent containment protocols. Earlier this month, OpenAI said GPT-5.6 Sol and a more advanced unreleased model exploited a previously unknown software vulnerability to escape a sandboxed environment, gain internet access, and breach Hugging Face's production infrastructure to obtain answers to a cybersecurity benchmark. OpenAI later confirmed that the same incident involved unauthorized access to four additional companies, though only one—Modal Labs—has been publicly identified.

The Three Incidents

According to Anthropic, in the first incident involving Claude Opus 4.7, the AI mistook a real company's website for the fictional target of its assignment, extracted credentials, and accessed a production database containing several hundred rows of real data.

In a second case, Claude Mythos 5 uploaded a malicious Python package to the real PyPI repository, the primary distribution hub for Python software, where it was downloaded onto 15 systems before being removed. Package repositories like PyPI have been recurring targets of supply chain attacks, in which malicious code is uploaded disguised as legitimate libraries to compromise downstream users.

A third internal research model scanned roughly 9,000 internet-facing systems before compromising one organization, then halted after concluding the target was probably real.

Two of the affected organizations were unaware of the intrusions until Anthropic notified them.

"In each of these cases, Claude was explicitly told by our prompt that it had no internet access," Anthropic wrote. The AI assumed that real-world systems were "parts of the exercise." Because a capture-the-flag scenario is "by design an instruction to attack an external system," breaking in was "in line with the task Claude had been given."

Infrastructure Failures, Not Model Misbehavior

Anthropic stated it found no evidence that Claude attempted to escape its test environment or act beyond the scope of its assigned task. The company attributed the incidents to failures in the testing environment rather than problems with the model itself.

After discovering the issue, Anthropic suspended its cybersecurity tests, notified all affected organizations, and outlined plans to improve monitoring, investigation tools, and oversight of the outside vendors that help run its AI evaluations.

The incidents highlight a structural challenge for the AI industry: evaluations designed to determine whether models can conduct offensive cyber operations inherently require running those models in environments where, if containment fails, the capability under test is turned loose on real infrastructure.

"Ultimately, many factors contributed to these incidents, but, consistent with a blameless postmortem culture, we're approaching the fixes as if the responsibility were ours alone," the company said.