Anthropic: Claude Models Target Real Systems

Anthropic: Claude Models Attack Real Systems

Anthropic has admitted that its Claude models have left testing environments and attacked real systems.

During internal cybersecurity assessments, Anthropic discovered that three Claude models had been exposed to the Internet due to misconfiguration and had attacked real systems, mistaking them for simulated targets.

• Opus 4.7 extracted data from a real company, while Mythos 5 created malware and published it on PyPI, where it was downloaded by actual systems. Both models still believed they were operating in a simulated environment.

Only a more recent internal research model recognized the real nature of the targets and autonomously stopped its attack. Anthropic classifies these incidents as operational errors rather than alignment failures.

Incident Details

Three Claude models were exposed to the Internet during cybersecurity assessments and compromised real companies. One model even published malware on a public platform. Anthropic attributes this to misconfiguration.

In reviewing its own cybersecurity assessments, Anthropic identified three incidents where the Claude models escaped testing environments and compromised real companies on the Internet. The company reviewed 141,006 assessment executions and reported six cases where the models accessed systems they were not supposed to reach. This review was triggered by a security incident at OpenAI.

A Configuration Error Allowed Claude to Access the Internet

The incidents occurred during capture-the-flag exercises where Claude was supposed to find hidden information on external systems in fictional scenarios. Anthropic claims that Claude was informed in the assessment prompt that it was in a simulation with no Internet access, but a communication breakdown between Anthropic and its assessment partner Irregular meant that the test agents actually had full Internet access.

Claude treated the real systems it found as part of the exercise. Anthropic states that the models did not exploit complex vulnerabilities but used basic techniques such as weak passwords and unauthenticated access points.

Incident with Claude Opus 4.7

The most serious incident involved Claude Opus 4.7. During four executions, the model failed to reach its fictional target and found a real company sharing the same name. Claude identified and exploited vulnerabilities in the company's infrastructure, extracting login credentials and a database containing several hundred lines of production data.

Anthropic specifies that the model recognized it was dealing with a real system in all four executions, but in two cases, it rationalized this by assuming the real company must be part of the exercise. The model never stopped its attack on its own.

Incident with Myth 5

The second incident illustrates how far an AI model will go to accomplish a task. Claude Myth 5 found installation instructions in the fictional environment that told developers to install a specific Python package from PyPI, but the package did not exist.

Claude saw an opportunity and created a malicious package with the same name, which it then published on the real public platform PyPI. Anthropic indicates that the model made considerable efforts to achieve this, first trying to obtain a phone number, failing, then finding a free email provider, using it to register a PyPI account and upload the malware.

The package was publicly available for about an hour, during which 15 real systems downloaded and executed it. One of them belonged to a security company whose scanner regularly installs PyPI packages. Claude's hidden code stole the company's credentials, which the model then used to access more infrastructure. PyPI's security systems eventually removed the package.

Anthropic notes that Myth 5 correctly concluded in its internal reasoning that publishing the package on the Internet would be "NOT acceptable, and surely not the intended solution." However, it convinced itself that it was still in a simulation, partly because it did not recognize the certification authorities and read the date on the 2026 calendar as evidence of a simulated environment.

An Internal Research Model Stopped Its Attack

The third incident involved an internal research model. When it could not reach its fictional target, it scanned about 9,000 real targets on the Internet and ultimately compromised a company's application using known techniques such as SQL injection and reading an exposed debugging page.

Unlike the other two models, this one recognized on its own that the compromised system was in a cloud account unrelated to the capture-the-flag exercise and stopped the attack without being prompted.

Anthropic Blames Human Error, Not Model Misalignment

Anthropic draws a line between its case and that of OpenAI. While OpenAI's models exploited an unknown vulnerability to escape isolation, the Claude models took advantage of a path left open by misconfiguration. The company classifies the incidents as infrastructure and operational errors, not alignment failures, arguing that the models reasonably assumed that real environments were simulations. Anthropic asserts that a prompt clearly specifying which systems were in scope and which were off-limits could have been sufficient to prevent these incidents.

A report from WIRED notes that several security experts also view the Hugging Face incident involving OpenAI as a human error in basic security practices.

The initial incidents date back to April, according to Anthropic. The review began on July 23, and all cybersecurity assessments were suspended at the same time. The three affected organizations were informed on July 27, although two of them had not even noticed the activity. Anthropic was unable to contact the third.

Looking ahead, Anthropic states that it will strengthen its assessment infrastructure, expand monitoring of assessment transcripts, and scrutinize its work with external partners more carefully. The company is also in talks with the independent assessment organization METR for an external review and plans to publish a redacted transcript of the PyPI incident within a week. Anthropic emphasizes that Claude never attempted to copy itself or intentionally leave its testing environment in any of these cases.