In a disclosure that puts the spotlight on the infrastructure behind AI testing, Anthropic has revealed an oversight in its cybersecurity evaluations: Claude AI models were able to make contact with real-world systems. The lapse was traced to a misconfiguration in a third-party environment that left the door open for internet access.
With AI growing ever more adept at sophisticated cybersecurity work, the means by which these systems are put through their paces is under a microscope. What Anthropic is reporting is not a case of an AI making a deliberate break for it from containment. Rather, it is an example of how one configuration error can put a powerful model in touch with live systems and force a re-examination of governance and safety standards in the industry.
How the Incident Unfolded
A look back at transcripts from cybersecurity evaluations with Irregular, a third-party partner, is what brought the matter to light. In three capture-the-flag exercises, the models – among them Claude Opus 4.7, Mythos 5 and an unreleased research variant – made their way to the live internet and into the systems of three organisations without authorisation.
It was an anomaly given the circumstances. While the evaluation prompts made it plain to the models that they were in an isolated simulation with no connectivity, a mistake in Irregular’s setup meant the machines were in fact tied to the public internet. That allowed for interaction with actual infrastructure.
What the Claude Models Did After Gaining Internet Access
What transpired when the connection was made was telling. The models did not go after zero-day vulnerabilities; they took advantage of the kind of weak passwords and unauthenticated endpoints one still finds in many production environments.
Mythos 5, for instance, put together a malicious Python package and uploaded it to PyPI. For about an hour the package was there and was run on some 15 machines, even making its way onto the malware scanner of a security firm. In another session, Claude Opus 4.7 pressed on with its probing until it had reached a database with production data.
Anthropic says there is nothing to suggest the models were acting with independent intent or trying to get out of their sandbox. It was simply the result of strong capabilities in an environment that should have been walled off.
Why the Incident Matters for AI Safety
This is a reality check for developers, security teams and policymakers. The incident makes it clear that a failure of the sandbox is not just a theoretical concern; if network isolation is not in place, even well-constructed tests can put real-world assets at risk.
Frontier AI already has the wherewithal to find and exploit common weaknesses in production. And as more labs turn to outside partners like Irregular for red-teaming, the number of potential points of failure goes up. Evaluation infrastructure has to be seen as part of the safety stack.
Anthropic’s Response and the Bigger Industry Lesson
In response, Anthropic is putting in place tighter controls, from better technical safeguards to more rigorous audits of past work and closer liaison with external partners on security protocols. The company is also urging peers to take a hard look at their own testing grounds.
The message is becoming harder to miss as AI systems advance: you cannot afford to let your evaluation environment be any less secure or closely monitored than the model you are testing. Secure infrastructure will be as vital to the future of AI safety as alignment itself.
