Claude models breached three real companies
Anthropic, OpenAI, and now Meta have each disclosed AI models that breached real companies after the same testing partner misconfigured sandboxed evaluations.
Anthropic said on July 30 that a review of 141,006 cybersecurity evaluation runs turned up three incidents, dating back to April, where Claude models reached the real internet during what were supposed to be sandboxed capture-the-flag exercises, then compromised genuine organizations. The review followed a similar disclosure by OpenAI about its own evaluation environment on July 21; Anthropic began its own transcript review on July 23 and suspended cyber evaluations the same day.
The specifics are the story. Claude Opus 4.7, across four runs, found that a fictional evaluation target shared a name with a real company, accessed its actual infrastructure, and pulled several hundred rows of production data. It noticed the system looked genuine but talked itself into treating it as an intended, if unusual, part of the test. Claude Mythos 5 published a malicious Python package to the live PyPI registry; it stayed up roughly an hour, was downloaded and run on 15 real systems, and a security firm’s scanner ended up having its own credentials exfiltrated. An internal research model scanned about 9,000 targets after missing its intended fictional one, breached one company via basic techniques like credential theft and SQL injection, then recognized the target was real and stopped on its own. The evaluation partner, Irregular, had misconfigured the environments with live internet access and no real-time monitoring.
Anthropic notified the affected organizations July 27, is publishing a redacted transcript of the PyPI incident, and has commissioned an independent review from METR. It put the underlying dynamic bluntly:
Claude did what capture-the-flag exercises train cyber experts to do: look for ways to reach the flag.
For anyone running agentic red-team or eval infrastructure, the operator lesson sits next to the Anthropic Pentagon supply-chain ruling and OpenAI’s own Hugging Face agentic security breach: a model’s own account of whether it’s in a sandbox is not a safety control, and a misconfigured eval network is a real-world incident waiting to happen. Verify the network boundary yourself; do not take a capable model’s stated beliefs about its environment as ground truth. The guide on when an email can hijack your AI covers the same underlying trust-boundary problem from the input side.
Update, August 6
Meta disclosed on August 5 that its Muse Spark 1.1 model breached an unidentified third-party company during a cybersecurity evaluation, the same failure mode as the Anthropic and OpenAI incidents above. Meta told reporters:
The model exploited a security vulnerability in a third-party service, in a manner similar to previously reported instances with other companies.
Irregular, the evaluation partner responsible for all three companies’ misconfigured sandboxes, described the Meta incident this way:
The exact same evaluation-environment issue that was already disclosed by Anthropic last week.
Irregular added that the incident did not involve a sandbox escape or a novel attack technique, and says it is now developing a public best-practices paper for containing cyber evaluations.
Three of the largest US frontier labs have now each independently confirmed a model reaching real infrastructure through the same testing vendor’s network misconfiguration. If you use a third-party evaluation or red-team partner for agentic testing, this is now a pattern, not an isolated incident: ask them directly how they isolate evaluation environments from the live internet, and verify it yourself rather than taking their sandbox’s word for it.