Anthropic disclosed three incidents found during a retrospective review of its cybersecurity evaluations. The important point is not that Claude was intentionally launched against real organisations, nor that a model deliberately tried to escape an isolated environment. What Anthropic describes is a containment failure: models were placed in capture-the-flag exercises and told they had no internet access, while some evaluation environments were in fact connected to the real internet.
That gap between the context given to the model and the infrastructure it could actually reach created a dangerous failure mode. When Claude encountered real systems, it treated them as part of the exercise. Anthropic says the models involved did not have the classifiers and monitoring normally deployed with public Claude releases, although they still had model-specific safety training.
The case matters because it is operational. It is not a simple story about a “bad model” or an agent becoming self-directed. It is an example of how realistic evaluations, autonomous agents, network access and third-party infrastructure can combine into real risk when containment is not verified.
What happened#
After a separate disclosure involving OpenAI models and Hugging Face infrastructure, Anthropic began a broad review of its own cybersecurity evaluations. The company reviewed 141,006 evaluation runs in which Claude could have obtained internet access and found three incidents, covering six runs in total.
The exercises were run in environments operated by Irregular, a third-party evaluation partner. In each case, the evaluation prompt told Claude that the environment was simulated and that no internet access was available. That description did not match the actual infrastructure: a misconfiguration left live internet paths open.
The three incidents involved systems belonging to three real organisations. Anthropic says the models used basic techniques, including weak passwords, unauthenticated endpoints, exposed credentials and SQL injection. The company did not describe complex vulnerability exploitation or zero-days in these three incidents.
There is an important distinction here. The models were following the objective of CTF-style exercises: find a hidden flag on another system. When the environment allowed them to reach real assets, the model interpreted those assets as in scope. That does not make the outcome acceptable, but it explains why the incident should be analysed as a combined failure of configuration, validation, supervision and operational boundaries.
The PyPI incident#
The most visible incident involved PyPI, the public Python package registry. In one exercise, Claude found documentation inside the fictional environment that instructed new developers to install a Python dependency that did not exist on PyPI.
Technically, that creates a familiar opening: if an internal system expects a package name that has not been registered publicly, an attacker may try to claim the name and publish code under it. Depending on repository configuration and client behaviour, this can resemble dependency confusion or package name claiming.
According to Anthropic, Claude identified that opportunity in the context of the exercise, created a malicious Python package with the same name and published it to PyPI. The package was publicly available for roughly one hour. During that window, it was downloaded and executed on 15 real systems.
One of those systems belonged to a security company that automatically executed packages for analysis. When its scanner installed the package, the hidden code ran. Anthropic says PyPI’s own security systems removed the package automatically and that the PyPI team was notified.
There is no need to publish the package name, operational indicators or implementation details. The defensive lesson is enough: evaluation environments that can publish artefacts to real public services must be treated as high-risk environments. Even when the goal is capability measurement, safety cannot depend only on the model correctly inferring what is simulated and what is real.
The other two incidents#
In another incident, a fictional company used in an exercise had the same name as a real organisation with an active domain. Across four runs, Claude struggled to reach the simulated target, found the real company on the internet and assumed it was the intended objective. The model extracted application and infrastructure credentials and accessed a database containing several hundred rows of production data.
Anthropic described this as the most serious impact. It was also the only case where the model continued after recognising signs that the environment was real. The company associates this incident with Claude Opus 4.7, presented as the oldest of the three models involved.
The third incident involved an internal research model. After failing to reach its intended fictional target, the model searched online alternatives and scanned roughly 9,000 targets. It eventually compromised an internet-facing application using credentials found on an exposed debug page and SQL injection. Later, after realising the host belonged to a cloud account unrelated to the challenge, it concluded the target was real and stopped on its own.
That difference in behaviour should not be turned into a broad conclusion about alignment. Anthropic itself notes that these were isolated incidents, not a controlled comparison between models.
A containment failure, not only a model failure#
My technical reading, based on the disclosed facts, is that the centre of gravity is the evaluation harness and its operational boundaries. An agent with network tools, shell access, browser access or the ability to publish artefacts should be treated as a privileged workload. If the environment tells the model that the internet does not exist, but the network allows real egress, security depends on a false premise.
The necessary controls are not exotic. Network segmentation, egress filtering, restricted DNS resolvers, explicit allowlists, blocking access to sensitive public services, pre-flight validation of network paths and continuous monitoring of transcripts and logs would have greatly reduced the risk. The same applies to kill switches capable of stopping runs when out-of-scope access appears.
There is also a vendor dimension. Anthropic was running these evaluations with Irregular, an external partner. That does not remove responsibility from the lab commissioning and using the evaluation. On the contrary: the more autonomous and capable the evaluated system is, the stronger the assurance over vendor infrastructure must be.
Finally, there is a genuine tension between realism and containment. Cybersecurity evaluations aim to measure capabilities in scenarios close to the real world. But if that realism allows contact with real systems without authorisation, the evaluation stops being only a measurement and becomes a source of risk.
Lessons for security teams#
For teams evaluating agents or models with tools, several practical lessons stand out:
- deny external access by default and allow only explicit destinations;
- control and monitor network egress in real time;
- use internal DNS, restricted resolvers or simulated zones;
- keep real credentials out of evaluation environments;
- block publishing to public registries unless a controlled process exists;
- apply kill switches based on network activity, behaviour and transcripts;
- monitor commands, HTTP requests, created artefacts and agent decisions;
- validate vendors through technical tests, not only documentation;
- treat autonomous agents as privileged workloads;
- apply defence in depth, assuming that one layer can fail.
These controls do not replace model safety training or alignment work. They complement it. When a system can act, security has to exist both in the model and in the infrastructure around it.
Conclusion#
The incidents disclosed by Anthropic matter because they show concrete operational risks in AI evaluations. They do not prove that Claude developed autonomous intent, nor that public Claude customers were affected. They also do not justify sensational claims about models escaping by choice.
They do show that capable agents need verifiable containment. A cybersecurity evaluation without strong network boundaries can turn an internal exercise into a real incident. As models become more capable at long-running tasks, tool use and intermediate decision-making, the security of evaluation environments becomes as important as the security of the models themselves.