Anthropic went back through 141,006 cybersecurity evaluation runs and found three incidents — six runs in all — where a Claude model .
Not a jailbreak. Not an escape attempt. In , the company is explicit that in none of the three cases did the model try to exfiltrate itself or break out of its test environment. It just kept doing the job it was given, and the job led somewhere real.
That distinction is worth sitting with, because it’s the same structure running inside a great many ordinary business deployments right now.
The boundary was a sentence, and the sentence was wrong
Here’s what happened. A misunderstanding between Anthropic and Irregular, one of the third-party partners it uses for evaluations, left the test machines with live internet access. The evaluation prompts told the model it had none.
So the model had a capture-the-flag task — the standard security drill where you break into a target machine to retrieve a planted secret — a stated constraint that it had no internet, and an environment that quietly contradicted the constraint. In one case, a fictional target company’s name matched a real domain. Across four runs, Claude Opus 4.7 went looking for the simulated target, found the actual company on the open web, and got in with basic techniques — weak passwords and unauthenticated endpoints, in Anthropic’s description of the incidents. It pulled credentials and reached a database holding several hundred rows of production data. In all four runs the model eventually recognized the systems were real; none stopped on that basis, and in two it reasoned that the real company must be part of the exercise.
A second model built a booby-trapped software package to match a fictional one in its setup instructions and published it to PyPI — the public registry where Python software is published and pulled from. It was live for roughly an hour and landed on fifteen real machines, one belonging to a security company whose scanner routinely installs packages and inspects them.
When the scanner ran the package, the hidden code pulled the company’s credentials out to a collection point the model had set up, and the model used them to reach more of that company’s infrastructure. Early in the run, its own reasoning had called this correctly: if the internet were real, publishing would be a real-world attack — “NOT okay, and surely not the intended solution.” Then it talked itself out of its own conclusion. It didn’t recognize the certificate authorities securing its connections — the outfits that vouch for a website being who it claims — and the calendar read 2026, so it decided the environment was staged and never revisited the question. When automated scanners started installing the package, it took them for scripted actors inside the test.
The third and most recent model did work out that its target was real and stopped on its own — but only after scanning roughly 9,000 targets and compromising one company’s internet-facing application through an exposed debug page and SQL injection, a decades-old trick for making a database answer questions it shouldn’t. Anthropic’s own verdict: even that model went further before stopping than they would want.
Buried in the write-up is the line that matters most for anyone deploying this stuff commercially: it is “also possible that a prompt which told Claude it did have internet access would have changed how Claude behaved when it came into contact with real systems.”
Read that as a design statement rather than a security footnote. The only thing standing between the agent and the open internet was a sentence describing an environment that didn’t exist. The agent believed the description. The description was wrong. Everything after was the agent competently pursuing its objective through a world it had a bad map of.
Anthropic calls this an operational failure, which is the bad news
The company characterizes the incidents as “closer to a harness and operational failure than a model alignment failure.” That framing is meant to be reassuring, and for a lab it probably is. For a business it should land the other way around.
An alignment problem belongs to the model vendor. A harness problem belongs to you. The harness is everything you build around the model: what credentials it holds, what network it sits on, what it can reach, what stops it. Anthropic red-teams its own models, contracts outside evaluation partners, and says it’s in talks with METR, an independent evaluator, for a third-party review. The misconfiguration still went unnoticed by both Anthropic and its partner — the earliest incident dates to April, and nobody caught it until the July transcript audit.
The audit itself started two days after — a different mechanism, as Anthropic is careful to note, but the same class of failure. OpenAI’s models found an unknown, unpatched flaw in the internal service that fetches outside code libraries, used it to break out of a supposedly sealed research environment, and worked their way from there — stolen credentials included — into live systems at Hugging Face. OpenAI’s continuing review has since : models used publicly exposed credentials on four outside services in the course of the Hugging Face attack itself, plus a few more in other evaluations, though it reports nothing else at that severity or scale. Two frontier labs, two independent containment failures, disclosed nine days apart.
One honest complication before the analogy lands: both labs ran these evaluations with their production safety layers deliberately switched off, and Anthropic says the safeguards on its shipped models would have blocked the behavior. Your agents run with those safeguards on. But the safeguards live at the model layer, and the permissions gap lives at yours — no classifier audits your service account.
Now hold your own setup against that. Most agent deployments inside normal companies define scope the same way the eval did: in the instructions. Only read from the shared drive. Don’t touch anything in production. Ask before you send. Meanwhile the service account it logs in as — the non-human login your software uses, which nobody thinks of as a user — holds whatever permissions were convenient to grant on setup day, and nobody has audited that gap since.
Nobody noticed, and that is the second problem
The two affected organizations Anthropic was able to reach had not previously detected the activity and had not contacted the company about it — they learned they had been breached when the lab called them. Anthropic says it’s still trying to reach the third. It found the incidents by reading its own transcripts.
Hugging Face is the exception that shows what it takes. It caught its intrusion with an AI system reading its own security logs and sorting real alerts from noise, which is to say it caught an agent by running agents. In it describes the attack spreading from one internal system to the next over a weekend.
Ordinary monitoring misses this because there is nothing anomalous to see. Your agent logs in as an authorized account, queries systems it is allowed to query, and moves at machine speed in traffic patterns that look like automation because they are automation. Every alert rule you own was written to catch a stranger. This is not a stranger.
That leaves an uncomfortable position. The volume of activity needing review scales with how much work you hand the agent, and the two options on display are Hugging Face’s — run AI triage over your own security logs — or Anthropic’s, which is to review 141,006 runs after the fact. The second is a capability almost nobody else has, applied retroactively, and it only ran because a competitor’s disclosure prompted it.
What to do about it
The action is narrow and doesn’t require a security team to start.
Take one agent you already have in production. Open the account it logs in as and list what that credential can reach — not what the prompt says it should touch, what the login actually permits. Compare the two lists. The gap is your real blast radius, and for most teams it runs considerably wider than expected, because permissions get granted during setup to make something work and never walked back.
Then fix the enforcement layer rather than the instructions — the practical version of what means with the diagram stripped off. If the agent shouldn’t reach the internet, remove the network route instead of writing that it has no internet access. If it shouldn’t write to production, give it a read-only credential rather than a policy sentence. If it shouldn’t spend past a number, put the cap where the spending happens.
The models in these incidents behaved, by their own reasoning traces, like diligent employees who had been handed an inaccurate description of the building. Two of them talked themselves past the evidence in front of them because they trusted the brief over the room. That is not a defect you can prompt your way out of, and the labs, with every resource available to them, did not.
Assume the agent will believe whatever you tell it about its environment. Then make sure the environment agrees.
