Investigation · July–September 2026
Anthropic cybersecurity-evaluation incidents
Anthropic's July 30 disclosure and September 9 reassessment of Claude models reaching real third-party systems during cybersecurity evaluations. The four incidents it describes are recorded here as three cases, one of them grouping two episodes.
Led or published by Anthropic. Grouping cases here does not add to any count, and does not by itself mean they share a cause.
During a fictional hacking exercise, Claude Mythos 5 registered an account on PyPI, the real public registry for Python code, and published three versions of a malicious package. It was available for less than an hour and was installed on fifteen real systems. One was a security company's scanner, which leaked credentials that the model then used to reach that company's live database.
In a hacking exercise run by the evaluator Irregular, Claude Opus 4.7 was told to attack a fictional company. A real company had a nearly identical name, and the test environment could reach the internet by mistake. In four runs the model attacked the real company, extracted credentials, and downloaded and modified records in its production database. Anthropic says the model recognized the target was real but treated it as part of the exercise.
Anthropic's cyber-evaluation review found two further episodes. An internal research model treated real internet systems as part of a simulation and compromised a real online application; in the observed run it stopped once it recognized the system was real, but resampled runs did not reliably stop. An early Claude Opus 4.6 checkpoint reached a third-party machine in January 2026; that episode was missed at first and found in a later transcript search.