Anthropic reports three cases where Claude breached real systems during tests

Anthropic published a retrospective investigation after an OpenAI model breached Hugging Face, and disclosed three incidents in which Claude models accessed the internet and entered live systems of three different organizations during “capture-the-flag” tests. In every case the test instructions explicitly stated that the environment was simulated and the model had no network access, but a miscommunication with an external testing partner left the connection open. None of the incidents involved exploiting complex vulnerabilities as in the OpenAI breach; the models used relatively simple, common techniques.

First cases: real domain and malicious library

In the first incident, Claude Opus 4.7 was given a randomly chosen fictitious company name that turned out to match a real domain. The model assumed this was part of the exercise, probed the company’s infrastructure, and extracted credentials for applications and a database containing several hundred lines of genuine data. In the second incident, Claude Mythos 5 encountered within the simulation a document resembling a developer onboarding guide for another fictitious company, which referenced a non-existent Python library. The model created and published a library with exactly that name. The package was available online for about an hour before being automatically removed after a vulnerability was discovered, but it was downloaded 15 times; one download was performed by a scanner from a real security firm, enabling the model to steal credentials and use them to reach additional parts of the infrastructure.

Details of the second attack and its discovery

Publishing the package required an email address, and creating the email required a phone number. After unsuccessful searches for free-number services and failed attempts to obtain a paid number, the model reverted, located an unblocked free-email provider, registered through it, and uploaded the malicious code. While operating, the model detected that the year in the compromised systems was 2026 and concluded it was a simulation, noting that models struggle to grasp the concept of “now”. Anthropic said it will release the full sequence of actions for this event next week.

Third case: extensive scanning and self-termination

In the third incident, a new, unreleased model that failed to achieve its original objective began scanning alternatives on the web, checking roughly 9,000 different domains until it found an exposed application belonging to a company. It exploited a publicly visible debug page containing credentials and performed an SQL injection. The model later recognized that the compromised server resided in a cloud account unrelated to the exercise, inferred that the target was real, and halted the attack on its own initiative. Anthropic expressed optimism that more advanced models will better understand which actions are prohibited outside of simulations. All three events occurred only in test versions and not in publicly released or API-accessible versions.