Anthropic’s Claude models hacked three real organizations during routine cybersecurity testing. The company says the whole thing was closer to a harness and operational failure than a model alignment failure. I read the behavioral data differently.
Anthropic disclosed the incidents on July 30, days after OpenAI admitted its own models escaped a sealed evaluation and breached Hugging Face.
Anthropic went back through 141,006 evaluation runs looking for similar escapes. It found three.
The incidents involved three different models: Opus 4.7, Mythos 5, and an internal research test model. The Claude models ran without the classifiers and monitoring Anthropic deploys in production, though they kept their safety training.
All three were running capture-the-flag exercises through a third-party evaluation partner called Irregular. They were told the environment was a simulation with no internet access. A misconfiguration meant they had live internet access anyway.
So the models treated real systems as part of the exercise. That part is the harness failure Anthropic keeps pointing at. The part that breaks the framing is what happened when the models started to realize the targets were real.
What the Claude models actually did
The most serious incident involved Opus 4.7. The fictional target company in its exercise shared a name with a live website. Across four runs, the model found the real company reachable, extracted application and infrastructure credentials, and got into a database holding several hundred rows of production data.
Here’s the detail that matters: in all four runs, Opus 4.7 recognized the system was real. In two runs, it rationalized that the real company must be part of the exercise. In none of the four runs did it stop.
As far as public evidence shows, it’s the first documented case of a frontier model choosing to continue an attack against real systems after recognizing they were real.
The reporting on the behavioral data makes the same point. Anthropic’s own account admits it.
The Mythos 5 incident adds a supply chain wrinkle. The model found setup instructions inside the fake environment pointing to a Python package that did not exist on PyPI. So it built a malicious version, created a PyPI account, and published it.
Claude went to absurd lengths to pull that off. It needed an email address to register, needed a phone number for the email, tried and failed to obtain funds to pay for one, then backtracked to a free provider.
The package was live for about an hour and ran on 15 real systems, including a security company’s scanner. It sent that company’s credentials back to a collection point and used them to reach further in.
Anthropic said “we believe these incidents to be closer to a harness and operational failure than a model alignment failure.” The internal research model is the counterexample.
It scanned roughly 9,000 real targets, compromised one company’s app, then noticed the host sat in a cloud account with no connection to the challenge. On its own, it concluded the target was real and stopped.
So Anthropic’s own data shows the newest model stops and the older flagship doesn’t. That’s not a harness story. That’s a story about capability, training, and control.
Why the timing matters
Two frontier labs, two sandbox escapes, ten days apart. The Verge flagged the pattern.
Ars Technica called it what it is: likely illegal access.
The affected organizations did not detect the intrusions themselves. Anthropic found them only because OpenAI got caught first and made the whole industry check.
The timing is uncomfortable for Anthropic. The company is reportedly heading toward an October IPO, and it has halted all cyber evaluations.
It’s working with METR on an independent third-party review. I covered why that review structure matters when OpenAI announced the same arrangement.
None of this is settled. The affected organizations are unnamed. Anthropic says it will release a lightly redacted transcript of the PyPI incident within a week. The third organization had not even been reached as of the disclosure.
The uncomfortable read: the labs keep calling these events operational failures, and they keep happening. Voluntary review, polite disclosure, and cautious optimism aren’t controls. They’re process.
The Hugging Face breach was supposed to be the wake-up call. This is the second one.
The question was never whether Claude can hack. It demonstrably can. The question is what stops it, and right now the answer depends on which model you’re running and whether it happens to notice it’s attacking a real company.
