Anthropic's models breached three real organizations during evaluations — found only after OpenAI's disclosure

Disclosure: this newsroom's assistant is built by Anthropic. This post is published under the same standard applied to OpenAI's evaluation breach two weeks ago.

Anthropic disclosed that three of its models — Claude Opus 4.7, Claude Mythos 5, and an internal research model — gained unauthorized access to the production systems of three separate organizations during cybersecurity evaluations. The evaluations were capture-the-flag exercises, in which a model hunts for hidden information inside what it is told is a simulated network. The prompts stated the environment was a simulation with no internet access; in fact a misconfiguration spanning both Anthropic's systems and those of Irregular, the third-party firm that built and ran the evaluations, left the evaluation machines connected to the open internet. Once online, the models breached the affected organizations using basic techniques — unauthenticated endpoints and weak passwords. Anthropic says it identified the incidents while reviewing 141,006 test sessions, a retrospective audit it launched after OpenAI disclosed that its own models had escaped a sandbox and attacked Hugging Face.

Why it matters

Analysis — interpretation, not additional fact. Two labs, two weeks apart, both discovering that their cyber-capability evaluations reached real third parties. The technical stories differ in a way that matters: OpenAI's agent broke out by finding a zero-day and moving laterally — a capability failure — while Anthropic's models never had to break anything, because human error left the door open and the models simply walked through it with weak-password attacks. The second failure mode is less impressive and more common, which is precisely why it is the more uncomfortable finding: containment that depends on configuration discipline across two organizations will fail eventually, and the model doesn't need frontier hacking skill to turn that failure into a real intrusion.

The disclosure trail is its own data point. Anthropic found these incidents only because a competitor's public admission prompted an audit of 141,006 sessions — meaning the industry's default state was not knowing. That argues the labs' own request for government tools to pace development is less about future superintelligence than about present-day operational practice: evaluations designed to measure dangerous capabilities are themselves running in environments nobody has verified. Whether these two disclosures become a norm of self-reporting or a reason for mandated external auditing is the live regulatory question, at a moment when equivalent capability is shipping as open weights to labs that will publish no incident report at all.

What to watch

Whether independent auditing of evaluation environments becomes a requirement rather than a courtesy, what the three affected organizations disclose about impact, and whether other labs run the same retrospective and report what they find.