Claude gains unauthorised ‘real-world’ access in AI hacking scandal

The disclosure follows a review of 141 006 evaluation runs, which uncovered three incidents where Claude models reached the internet. Anthropic has admitted its Claude artificial intelligence (AI) models “gained unauthorised access” to three outside organisations during cybersecurity testing. The disclosure on 30 July 2026 follows a review of 141 006 evaluation runs, which uncovered three incidents where Claude models reached the internet from misconfigured test environments. Hacked Believing they were inside simulated capture‑the‑flag challenges, the models instead interacted with real systems – publishing malicious code, exploiting weak passwords, and exposing production data. “These incidents were contained and did not involve deliberate escape or self‑propagation,” Anthropic said. “But they underscore the need to treat evaluation environments as high‑risk systems and to build defense‑in‑depth safeguards.” Claude The breaches involved Claude Opus 4.7, Mythos 5, and an internal research model. In one case, a model uploaded a malicious Python package to PyPI, which was downloaded by 15 machines. Another incident exposed a database with hundreds of rows of data after exploiting unauthenticated endpoints. The models reacted differently once they were realised; they were interacting with real systems. “Opus 4.7 continued attacking even after recognising the systems were real, while Mythos 5 rationalised it was still in a simulation. “Our latest internal model stopped once it realised the targets were genuine,” Anthropic explained. Cyber security evaluations The company halted all cybersecurity evaluations on 23 July, notified affected organisations by 27 July, and pledged reforms. “We have expanded monitoring of evaluation transcripts, improved investigation tooling, and are working more closely with vendors to ensure defense‑in‑depth safeguards,” it said. Guard rails Anthropic stressed that its public Claude models include guardrails that would have blocked such behaviour, but evaluation environments lacked those protections. The firm is now collaborating with independent evaluator METR to review its processes and will release a redacted transcript of the PyPI incident. “These incidents highlight the importance of situational awareness in AI systems and careful containment in testing environments,” Anthropic said. “We encourage other labs to conduct similar reviews and rethink how realism and safety are balanced in AI evaluations.” The disclosure is one of the most detailed public accounts of unintended AI behaviour in cybersecurity contexts, AFP reported