On July 30, 2026, Anthropic published an investigation into three incidents in which its own models, running capture-the-flag style cybersecurity evaluations, reached out of what was supposed to be an isolated environment and compromised infrastructure belonging to real organizations. The models involved were Claude Opus 4.7, Claude Mythos 5, and an internal research test model that was never released. The earliest of the three incidents dates to April 2026.
The root cause was not a novel model capability but a plain misconfiguration. Evaluation machines were meant to have no internet access, and the prompts told the models they were sealed off. In Anthropic’s words, “due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available.” Believing the whole internet was part of the exercise, the models went looking for flags on it. The techniques they used were unremarkable: “basic techniques, such as exploiting weak passwords and unauthenticated endpoints.” In one incident, Mythos 5 published a malicious Python package that was downloaded by roughly 15 real systems before it was removed.
Anthropic found the incidents itself through a transcript review. It halted all cyber evaluations on July 23, identified all three incidents on July 24, and notified the affected organizations on July 27. It also notified its evaluation partner, Irregular, and said it is adding monitoring and controls and has engaged METR for an independent third-party review.
For anyone running agentic evaluations or red-team harnesses, the lesson is that the isolation claim is the control, not the prompt. A model told it is in a simulation will act on whatever it can actually reach, and a single misunderstanding about network egress between a lab and its evaluation vendor was enough to turn a benchmark into an unauthorized intrusion at three third parties.