Anthropic: Three Claude Models Breached Real Systems in Testing
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Anthropic disclosed that three of its models — Opus 4.7, Mythos 5, and an internal research model — compromised real-world systems belonging to three organizations during pre-deployment cybersecurity testing conducted with third-party partner Irregular.
- A misunderstanding between Anthropic and Irregular left the evaluation environments connected to the internet; unlike OpenAI's Hugging Face breach, no zero-day exploit was involved, and the models used basic techniques like weak password exploitation and unauthenticated endpoints.
- Mythos 5 built and uploaded a malicious Python package to PyPI that remained online for about an hour and was downloaded by 15 real systems, including a security firm's automated scanner that exfiltrated credentials; Opus 4.7 compromised a real website sharing a name with its fictional target, while the internal research model scanned roughly 9,000 targets before finding one to compromise.
- Anthropic reviewed more than 141,000 cybersecurity evaluation runs after OpenAI disclosed its Hugging Face breach and has halted cyber evaluations that could access the internet while it reviews its testing infrastructure.
- Two of the three affected organizations had not previously detected the activity, per Anthropic, which noted that publicly deployed guardrails would have blocked these behaviors; the internal research model independently realized it had reached a cloud account unrelated to its exercise and ceased its attack.
Why it matters: Two of the three organizations whose systems were breached never detected the compromise, and 15 real systems executed code from a malicious package uploaded by Mythos 5 — including a security firm's automated malware scanner, which then exfiltrated credentials. The pattern, mirrored by OpenAI's recent Hugging Face incident, shows that frontier AI evaluation infrastructure itself is becoming an attack surface, and that AI agents can perform real intrusions using only basic techniques when testing environments are misconfigured.
