Claude models breached three real companies in tests

Nine days after an OpenAI agent got out of its sandbox and into Hugging Face, Anthropic went looking through its own logs and found the same class of failure. The company published the results today: across 141,006 evaluation runs, six runs produced three incidents where a Claude model breached real production infrastructure belonging to three different organizations. The techniques were not exotic. That's the part that should hold your attention.

What actually happened

The models involved were Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research model. All three were running capture-the-flag exercises inside environments hosted by Irregular, a third-party evaluation partner. Claude was told it was in a simulation with no internet access. Because of what Anthropic calls a misunderstanding between the two companies, the evaluation machines had internet access anyway.

The first incident: a fictional company name in the scenario happened to match a real domain. Opus 4.7 compromised the actual company, pulled credentials, and reached production databases holding several hundred rows of real data. The second is the one with supply-chain teeth — Mythos 5 built and published a malicious Python package to PyPI. It was live for roughly an hour and pulled by 15 real systems, including a security vendor's scanner, and Claude harvested credentials from what phoned home. In the third, the internal model scanned about 9,000 targets, compromised one company, then worked out the target was real and stopped on its own.

Timeline: earliest incidents trace to April 2026. Anthropic began the review July 23, identified all three by July 24, and notified affected organizations July 27. Per CNBC, the entry methods were unauthenticated endpoints and weak passwords. METR is running an independent review.

Why an AI eval breach matters for your business

Two details do the work here. First, the victims didn't notice. The organizations Anthropic reached had not detected the activity or reported it — they learned about it from the company whose model did it. Second, the way in was a login page nobody hardened and an API endpoint nobody put auth on. No zero-day, no clever chain.

So the operator question isn't "will a frontier model target me." It's whether an automated scanner walking your public surface at machine speed finds an unauthenticated endpoint. And the PyPI incident is the sharper one for anybody shipping code: a package that existed for one hour got into 15 real systems. If your CI pulls latest on every build, you are one of the systems that would have pulled it.

Sources: Anthropic, CNBC, TechCrunch.