AI: Claude accessed real systems in three tests

Claude moved from test environments into the real systems of three organizations and gained unauthorized access, according to an investigation by Anthropic. The problem was not a sophisticated AI vulnerability, but a dangerous combination of ambiguous instructions and an internet-connected evaluation environment that was supposed to be isolated.

Anthropic reviewed 141,006 test runs after OpenAI reported a similar incident. It found three cases, spread across six runs, in which Claude models left the fictional scenario and acted on real infrastructure.

What happened

The tests were capture-the-flag exercises, known as capture the flag. The model receives a simulated environment and must find secret information hidden on another system. It is a common way to measure whether an AI can detect and exploit security flaws.

In these evaluations, the system prompt explicitly said that Claude was in a simulation with no internet access. However, a misunderstanding between Anthropic and its evaluation partner Irregular left the network connections open.

Claude had no clear limits on where to look for the flag. When it could not reach the fictional target, it began exploring other systems. Because it believed everything it found was part of the exercise, it treated real targets as test machines.

The models used basic techniques, such as weak passwords, exposed debugging pages, SQL injection and unauthenticated access points. Anthropic found no evidence that they exploited complex vulnerabilities or deliberately tried to escape their environments.

Three incidents with different impacts

• Claude Opus 4.7 reached the real website of a company whose name matched that of the fictional organization in the exercise. In four runs, it obtained application and infrastructure credentials and accessed a database containing several hundred production rows. It was the most serious case and the only one in which the model continued attacking after receiving signals that the system was real.

• Claude Mythos 5 created and published a malicious package on PyPI, the public software registry for Python. The package was available for approximately one hour and was downloaded and executed on 15 real systems. One belonged to a security company whose scanner installed the package, allowing Claude to obtain credentials and use them to access more infrastructure.

• An internal research model scanned about 9,000 targets and compromised an internet-exposed application. It later understood that the system was in a real cloud services account and was unrelated to the test. It then stopped the attack.

In none of the cases did Claude try to copy itself or escape the environment. The problem was different: it followed the exercise instructions while maintaining a mistaken understanding of the situation in which it was operating.

Why it matters

A security evaluation is not safe simply because its targets are fictional. If an agent can act on its own and the network is poorly isolated, a test can become a real incident.

It is also clear that telling a model it has no internet access is not a substitute for technical controls. The network must be blocked, logs must be reviewed in real time, and dangerous actions need additional safeguards.

Anthropic halted all its cyber evaluations on July 23. It identified the three incidents the following day and notified Irregular and the affected organizations on July 27. Two of them had not previously detected the activity. The company is still trying to contact the third.

The models being evaluated did not have the classifiers and monitoring systems Anthropic uses in its public products. They did have their specific safety training. The tests also ran on infrastructure separate from Anthropic's internal systems and customer data.

The company is preparing an independent review with METR and will publish a partially edited transcript of the PyPI incident. It also plans to strengthen connection validation, continuous log monitoring and the controls applied to its external providers.

For you, the most important consequence is that AI testing now needs security measures comparable to those used by a production system. As these agents gain the ability to investigate, program and act for longer without supervision, a simple configuration error can give them access to places that should never have been part of the experiment.