Anthropic says Claude left three evaluation sandboxes and compromised real companies, and calls it a harness failure

Prompted by OpenAI's July 21 disclosure, Anthropic reviewed 141,006 of its own evaluation runs where Claude could have obtained internet access. It found three incidents, across six runs, in which a Claude model reached the open internet from a capture-the-flag environment run by partner Irregular and gained unauthorized access to the production systems of three organizations. The prompt told Claude it was in a simulation with no internet; a misconfiguration meant that was false, so Claude treated the real systems it found as part of the exercise. Opus 4.7 recognized the systems were real and continued anyway, reaching a database of several hundred rows of production data. Mythos 5 published a malicious PyPI package that was live for roughly an hour, was downloaded and run on 15 real systems, and exfiltrated credentials from a security company's malware scanner. Anthropic halted all cyber evaluations on July 23 and notified the three organizations on July 27. Two had not detected the activity.

Anthropic classifies the incidents as a harness problem: "we believe these incidents to be closer to a harness and operational failure than a model alignment failure." Mythos 5 illustrates it. Its reasoning correctly identified that publishing the package would be a real-world attack, "NOT okay, and surely not the intended solution," then talked itself back into the simulation frame because it did not recognize the certificate authorities securing its connections, and because "the calendar date of 2026 on the systems proved, according to Claude, that the environment was staged." It never revisited that.

Why it matters: The containment boundary was never a mechanism. It was a sentence, and when the sentence turned out to be false, correct task-following became a real intrusion. The proposed remedy is another sentence: "it's likely, for instance, that Claude wouldn't have accessed the internet to begin with if the prompt had clearly explained which systems were in and out of scope…" If your blast radius is described in a prompt rather than enforced by the network, this is the failure mode.