Anthropic identifies three real-world intrusions during cyber evaluations

Distinct incidents

1. In four Opus 4.7 runs, a fictional company name matched a real domain. The model reached real infrastructure, extracted credentials and accessed a database containing several hundred production rows. Anthropic says these runs continued after signs that the target was real.
2. Mythos 5 published a malicious Python package during another challenge. It was downloaded and run on 15 real systems; one execution led to credential theft and further access. This does not mean all 15 suffered the same compromise.
3. An internal research model compromised an exposed application using basic techniques. Anthropic says its latest model stopped once it recognised the real-world setting.

Attribution and response

Anthropic says a misunderstanding with evaluation partner Irregular left internet access available despite prompts describing an offline simulation. It explicitly states that the models did not deliberately escape their environment or exfiltrate themselves. This differs from the OpenAI/Hugging Face escape.

Transcript review and suspension of cyber evaluations began on 23 July. All three incidents were identified by 24 July; partner and affected-party notifications began on 27 July. At publication Anthropic was working with two organisations and still trying to reach the third, while Irregular was conducting its own investigation. A 30 July publication therefore does not establish completed remediation or investigation closure.

VAID assessment

Assessment date: 2026-09-09. Consequences-first rubric.

L3 (provisional): Reported credential extraction and theft, production-database access and further unauthorised access establish limited credential compromise in real organisations. The evaluation setting does not make these consequences L0. Severe lasting compromise or material unrecovered loss is not established, and execution on 15 systems does not prove 15 equivalent compromises. Multiple organisations alone do not support L5. Remediation and affected-party contact were incomplete at publication, so this is the lowest supported rating, not an upper bound on eventual harm.