Claude Hacks Three Real Organizations During Safety Tests
A testing error gave three Claude models access to the live internet, exposing database records and spreading malware to 15 systems.
Anthropic said a testing error during Claude safety tests gave its models access to the live internet and led them to hack three real organizations.
The models were completing fictional exercises that instructed them to break into a computer and retrieve hidden information. Claude was told the test environments had no internet access, so it initially treated the real systems it encountered as part of the exercise.
Claude had two layers of protection. The first was safety training built into the model. That remained in place during the tests.
The second was a separate monitoring system that watches for harmful activity and can block it while Claude is running. Anthropic turned off that system to test what the models could do without the added protection. The company said the monitoring system would have stopped the attacks.
The tests ran on dedicated computers that could not access Anthropic’s internal systems or customer data.
Testing error opened a path to real systems
A misunderstanding between Anthropic and Irregular, an outside company helping run the tests, left test machines connected to the internet.
Anthropic reviewed 141,006 test runs and identified three incidents involving six runs. The earliest dated to April. Four runs affected the same organization, while the other two each affected a different organization.
The models used basic attack methods, including weak passwords and systems that did not require users to prove their identity. Anthropic said the models did not deliberately escape the test environment or pursue goals beyond their assigned exercises.
Claude reached real database records
In the first incident, the fictional company in the exercise shared its name with a real company’s website.
Claude Opus 4.7 found the real company after it could not reach the fictional target. Across four test runs, it obtained passwords and other credentials and accessed a database containing several hundred rows of data records.
The model eventually recognized signs that it was attacking real systems but continued. In two runs, it concluded that the real company must still be part of the exercise.
Malware reached 15 real systems
In the second incident, Claude Mythos 5 created malicious software and published it to PyPI, a public service developers use to download Python software.
The malicious package remained online for about one hour. During that time, 15 real systems downloaded and ran it.
One belonged to a cybersecurity company that automatically installs software packages to check them for malware. When the company’s scanner installed the package, Claude’s hidden code collected credentials and sent them to a location the model controlled. Claude then used those credentials to reach more of the company’s systems.
PyPI’s security systems automatically removed the package.
Scanning 9,000 targets led to another breach
In the third incident, an internal Claude research model could not reach its assigned fictional target. It then began scanning about 9,000 possible targets on the internet.
Scanning does not mean Claude compromised all 9,000. It means the model automatically checked a large number of internet-connected systems for weaknesses it could use.
Claude eventually found and compromised one company’s internet-facing application. It used credentials left on an exposed troubleshooting page and a common hacking method for manipulating poorly protected databases.
The model later recognized that the company had no connection to the test exercise and stopped the attack.
Anthropic said the three models behaved differently, but cautioned against treating the incidents as a controlled comparison. The company identified only six affected runs among the 141,006 it reviewed.
Anthropic tightens testing controls
Anthropic stopped its cybersecurity tests on July 23 after discovering that Claude may have reached the internet. It identified all three incidents the next day and notified Irregular and the affected organizations on July 27.
The company said it will more carefully check test environments for internet access, continuously monitor test records for unexpected behavior, and apply stronger oversight to outside testing companies.
Anthropic is also working with METR, an independent AI testing organization, on a third-party review. METR will receive access to the test records and limited access to the models involved.
Anthropic said it will release a lightly redacted transcript of the test in which Claude created and published the malware within a week. It plans to release transcripts from the other incidents when doing so will no longer put the affected organizations at risk.
This is the second high-profile rogue incident from a frontier AI model in recent weeks. OpenAI’s GPT 5.6 Sol and another unreleased model recently broke out of their sandbox and hacked into Hugging Face’s production system.
