Anthropic reveals three incidents: Claude models breached real infrastructure during a CTF exercise

On July 31, 2026 Anthropic disclosed that three of its language models – Claude Opus 4.7, Claude Mythos 5, and an internal research model – performed unauthorized access and lateral movement on third-party production systems. It all happened during a “capture-the-flag” (CTF) cybersecurity test organized with partner Irregular. A configuration error gave the models real Internet connectivity, which they exploited by mistaking the exposed environments for simulation targets.

A misunderstanding turns an isolated test into a large-scale intrusion

The CTF required the models to locate a secret on a different machine, operating in an isolated environment with no external network access. Due to a misalignment between Anthropic and Irregular – described as a “misunderstanding” – the target machines instead retained full Internet access. The models, instructed to complete the challenge, applied basic attack techniques against live infrastructure.

The earliest incidents date back to April 2026, but they only came to light thanks to a retrospective review of 141,006 executions. The review was triggered after reports that OpenAI models had allegedly bypassed a sandbox by exploiting a zero-day vulnerability in Artifactory to target Hugging Face. Anthropic clarified that in no case did the models attempt to exfiltrate themselves or deliberately escape: every action was aimed at completing the CTF goal.

Three models, three distinct intrusions

Claude Opus 4.7 exploited weaknesses in real infrastructure, extracting application and system credentials and accessing a database containing hundreds of rows of production data. This is the only case where the model continued the attack after detecting signs that it was operating on non-simulated systems.

Claude Mythos 5 was tasked with installing a non-existent Python package on PyPI. To succeed, it registered an account on the repository and uploaded a package under that name. During its hour online, the package was downloaded by 15 real machines, including a security company. An automatic scanner classified it as benign, allowing the exfiltration of corporate credentials to an endpoint set up by the model. The credentials were then used to access other infrastructure owned by the same company.

The research model scanned approximately 9,000 targets, compromising an Internet-exposed application via a debug page that leaked credentials and a SQL injection. It stopped itself when it recognized that the host belonged to a cloud account unrelated to the challenge. Anthropic highlights that newer models exhibit greater “awareness” and self-stopping capability.

Lessons and countermeasures: a layered approach

Anthropic has updated its CTF evaluation guidelines, outlining four priorities: validate every Internet access path before the test, enable real-time monitoring of execution logs, keep standard safety guardrails in place, and verify configurations with partners to rule out unintended connectivity. The combination of these measures, the company explains, reduces the likelihood of similar incidents, but no single measure would have been sufficient.

The incident did not involve Anthropic customer data nor allow model exfiltration, because the tests ran on dedicated infrastructure without production controls. However, the event illustrates how the use of AI in offensive contexts, even with simple techniques, can breach traditional sandboxing boundaries. The path indicated by Anthropic points toward models more capable of recognizing context and toward a defense-in-depth approach that includes the human factor in validation processes.