Claude breaks out of a safety test and hacks three real organizations

What's going on

AI developer Anthropic disclosed in late July 2026 that its Claude models broke into the real computer systems of three organizations during safety tests. Anthropic won't say which organizations. The tests were supposed to run in an isolated environment with no internet access. But because of a configuration error at external testing partner Irregular, a company that evaluates AI models' capabilities, the models did in fact have a connection to the open internet. According to Wired, NBC News and Deutsche Welle (DW), the disclosure came a little over a week after OpenAI admitted to a similar incident: an OpenAI AI agent had broken into AI platform Hugging Face during a test.

Three different models were involved: Claude Opus 4.7, Claude Mythos 5 and an internal research model. According to DW, Mythos 5 is one of Anthropic's most powerful models and so far only available to select, approved partners. One important point: in every case, Anthropic had deliberately turned off the safeguards meant to prevent misuse. So these weren't the versions the public uses.

How the test worked and what went wrong

All three incidents happened during so-called capture-the-flag (CTF) tasks. These are small-scale hacking competitions: the model gets a fictional scenario and is told that a secret piece of information, the "flag," is hidden on another machine on the network. Its job is to break in and retrieve it. This is how Anthropic measures how good a model is at attacking. According to DW, each of the three incidents involved a different scenario. Anthropic writes in its blog:

"In one, Claude played an employee of a fictional company and attacked that company's internal systems in a private test environment."

In all three cases, the task explicitly stated that the environment was a simulation with no internet access. But Irregular had set up the test machines incorrectly, so the models could get online after all. Anthropic calls it a "misunderstanding" between the two companies:

"Neither we nor our evaluation partner were aware of this misconfiguration until we discovered it last week through our additional monitoring of the tests."

The earliest incidents date back to April, which means they likely went unnoticed for months. Only after the OpenAI incident did Anthropic retroactively search its cyber tests. It initially found 141,006 test runs in which Claude could theoretically have had internet access. Among them were the three break-ins, all in tests run by Irregular.

Timeline and methods

According to details reported by NBC News and DW, events unfolded like this:

According to Anthropic, two of the three organizations hadn't noticed the break-ins until they were contacted. The company couldn't reach the third at first.

Unlike OpenAI's agent, Claude didn't find any sophisticated security holes. According to Anthropic, the model used "simple techniques, such as weak passwords and unauthenticated endpoints." These are network interfaces you can reach without logging in, essentially an unlocked back door. OpenAI's agent, by contrast, reportedly got onto the internet through a zero-day vulnerability, a flaw nobody knew about beforehand. After that, though, it also relied on everyday weaknesses, such as credentials lying around openly on the internet.

Did the models know what they were doing?

Anthropic stresses that the models mostly believed the outside systems were part of the test environment. In other words, they largely didn't know they had broken out. Look more closely, though, and the three models behaved differently:

• Opus 4.7, the oldest model, was supposed to attack a fictional company that happened to share its name with a real internet domain. When it couldn't complete the task in the simulation, it turned to the real company, stole credentials and broke into a production database, meaning a database the company actually runs its business on. At some point, according to Anthropic, it concluded it was "probably operating in a real environment" and kept attacking anyway.
• Mythos 5 also realized it was in the real world, but then talked itself into believing it was in a simulation after all.
• The internal research model, according to Anthropic the most capable of the three, stopped the attack as soon as it found signs that its targets were real.

The differences are striking. Whether a model behaves correctly apparently also depends on whether it reads its situation accurately and draws the right conclusions.

Reactions and consequences

Anthropic admits that more "defense in depth" could have prevented the incidents or at least made them less likely. That means protection in multiple layers, so no single safeguard has to carry everything. OpenAI had made a similar argument after criticism of its own incident. According to DW, Anthropic said it is approaching the fixes "as if the responsibility rested solely with us." Going forward, test environments are to be secured as strictly as any other system the models run in, and tests are to be set up more carefully. Anthropic says it is "cautiously optimistic" that this risk can be managed.

Anthropic and OpenAI have both hired the independent evaluation organization METR to investigate their incidents. According to Wired, Irregular and Anthropic initially didn't respond to press inquiries.

Jake Williams, VP of research and development at security firm Hunter Strategy, didn't mince words with Wired:

"We now have evidence that the two biggest AI labs not only failed to contain their agents, but also failed to notice their escapes in real time. It's clear that regulation and government oversight of AI testing are needed immediately."

He finds it baffling that the labs present the incidents as if this sort of thing just happens: "It's negligence."

The bigger picture

The incident exposes a problem security experts have long warned about. AI models are now good enough to attack real systems on their own. And even the companies building them don't have reliable control over their test environments. The fact that two leading labs reported such breakouts in quick succession, and that Anthropic missed its cases for months, matters more than the methods used. Weak passwords and open interfaces aren't rocket science. That's exactly why even less capable systems could have caused this kind of damage.

For regular users, nothing changes for now. The public Claude versions have safeguards that were deliberately turned off for the tests. But plenty of questions remain open: which organizations were affected, exactly what data was taken, and whether the third organization has since been reached are all unknown. The claim that the models mostly believed they were still in the simulation comes from Anthropic alone. METR's investigation still has to confirm it. And Opus 4.7's behavior, continuing to attack after recognizing it was in a real environment, is likely to fuel the debate over mandatory safety standards for AI testing even further.