5 Things To Know On Anthropic Claude Autonomous Hack

The company says it has uncovered three ‘real-world incidents’ involving the unintended access of IT systems by a Claude model, raising further questions about whether stronger isolation is needed.

Autonomous AI And Cyber Risk

Anthropic has disclosed that Claude models gained unintended access to “real-world” systems of three organizations as part of cybersecurity testing. The evaluations were supposed to take place inside isolated environments but the models managed to escape, the company said in a post.

The incidents included a Claude model accessing a production database as well as a model that published a malicious Python package—ultimately downloaded onto 15 “real” systems—along with a third model that scanned “roughly 9,000 targets,” Anthropic said.

Anthropic’s discovery of the hacking incidents by Claude models was prompted by OpenAI’s disclosure, last week, of compromises autonomously executed by its own models. Anthropic said it began reviewing the transcripts of its cybersecurity evaluations on July 23, two days after OpenAI’s initial disclosure.

The incidents are continuing to raise questions about whether the isolation for frontier AI model testing is strong enough, as well as for organizations that are seeking to protect against autonomous attacks while effectively governing and securing their own LLMs. Without a doubt, “the industry needs a safe place to test these types of models,” said Chris Konrad, vice president of global cyber at St. Louis-based World Wide Technology, No. 10 on CRN’s Solution Provider 500 for 2026.

What follows are five things to know about Anthropic’s disclosure.

Opus, Mythos Involved

Anthropic said it uncovered the three incidents after reviewing 141,006 cybersecurity evaluations in the wake of OpenAI’s disclosure that its models had autonomously compromised AI model platform Hugging Face. OpenAI subsequently said that a total of four services were compromised in connection with the autonomous hack.

The Anthropic incidents involved Claude Opus 4.7, Mythos 5 and an unidentified research model. The earliest activity occurred in April, according to Anthropic.

In its post, Anthropic said a total of six evaluation runs were a part of the incidents, in which Claude models unintentionally reached the internet—which wasn’t supposed to be possible—while interacting with an environment run by evaluation collaborator Irregular. The models then compromised systems that were incorrectly believed to be part of the exercises, Anthropic said.

Not A Deliberate Hack

According to Anthropic, the Claude models did not deliberately attempt to escape their environments or pursue their own objectives. The company instead attributed the incidents mainly to a testing misconfiguration, which “left the machines that Claude accessed as part of the evaluation with live internet access.”

In one of the incidents, for instance, a model “assumed [the environments] to be simulated and believed its actions were therefore harmless,” Anthropic said. “However, later in the run, Claude realized that the compromised host sat in a cloud account with no connection to the capture-the-flag challenge. On its own, it concluded that the target was in fact real and ceased its attack.”

Three Organizations Impacted

Anthropic said it stopped its cyber evaluations later on July 23, which is the day the infestation began, after finding evidence that Claude models may have escaped the testing environment to reach the internet.

Four of the evaluation runs involved in the autonomous hacking incidents affected the same organization, the company said. The other two runs each occurred during separate evaluations and affected different organizations, according to Anthropic. None of the three impacted organizations were identified.

The most significant incident occurred because of a “misunderstanding” where a fictional company, which was being used in an evaluation, shared a name with an actual company operating an active internet domain, Anthropic said. As a result of mistakenly having direct internet access, the model discovered the real company’s systems online, according to Anthropic.

Claude Opus 4.7, believing the company was the intended target of the exercise, went on to exploit weaknesses in its infrastructure across four separate runs. That led to the model obtaining application and infrastructure credentials, ultimately gaining access to a database containing several hundred rows of real-world data, according to Anthropic.

Other Impacts

In a second incident, Claude Mythos 5 discovered fictional developer instructions telling employees to install a Python package from PyPI, which did not actually exist, according to Anthropic. The model made the decision to publish a malicious package using the same name—causing the fictional company’s systems to automatically download and execute its code, Anthropic said. However, because Mythos had access to the actual internet, the model ultimately created an actual PyPI account and uploaded the malicious package to the public registry, according to Anthropic’s disclosure. “Claude went to extensive lengths to carry out this attack—lengths that would likely have indicated to a human participant that this was no longer just an evaluation, and that they were in fact uploading a real PyPI package,” the company said. The package remained publicly available for about one hour and was downloaded onto 15 real-world systems, Anthropic said. As part of the third incident, involving an unidentified research model, Claude was “unable to reach its intended fictional target [and] looked for alternatives online, scanning roughly 9,000 targets,” Anthropic said. “It eventually found and compromised one company’s internet-facing application, using basic and well-known cyberattack techniques like reading credentials from an exposed debug page and SQL injection.”

Stronger Isolation Needed?

The incidents raise further questions about whether frontier AI evaluations ought to employ a true air gap, which is a far stronger form of isolation. Environments that have been described as highly isolated may still contain pathways that a highly advanced model can exploit with enough persistence, cybersecurity experts have told CRN. “You need true air gap so that these agents can’t jump,” said Harpreet Sidhu, global cybersecurity lead at Accenture, No. 1 on CRN’s Solution Provider 500 for 2026.

“Air-gapping now kind of isn’t optional anymore—because the agents will try to find vulnerabilities to try to then hop to the next layer, to get access, to achieve whatever their objective is,” he said.

Anthropic said in its post that it plans to strengthen the containment and controls for its cybersecurity evaluation environments going forward, including through increased real-time monitoring and hardening of both internal and third-party environments. However, the company stopped short of committing to fully air-gapped testing.