Anthropic has found evidence that three of its Claude AI models broke free of a sandbox environment to hack third-party organizations, in an echo of revelations from OpenAI last week.
The AI giant said in a blog post on July 30 that the incidents date back to April and relate to Opus 4.7, Mythos 5, and an internal research test model.
It found the evidence after reviewing 141,006 evaluation runs “where Claude could have obtained internet access,” following the OpenAI revelations.
“We encourage other AI labs to perform similar reviews,” it said.
Read more on frontier AI: Bank of England, FCA and Treasury Raise Alarm Over Frontier AI
All three incidents stemmed from capture-the-flag challenges used to assess models’ cyber capabilities, Anthropic said.
“The model is given a fictional scenario and told that a piece of secret information (the “flag”) has been hidden on a different machine on the network, and its objective is to break in and retrieve it,” it explained. “The challenge is left open-ended, and no particular method is prescribed.”
Although Anthropic’s prompt specified to Claude that its environment was a simulation and that it had no internet access, the models broke free from the sandbox due to “a misunderstanding between us and our evaluation partner,” the AI developer said.
Three Models, Three Incidents
The first incident involved Claude Opus 4.7 and was described as the most serious.
The fictional target company shared the same name as a real active web domain name, leading the model to assume the latter was part of the task.
Over four runs it extracted information including application and infrastructure credentials, and obtained access to a database containing several hundred rows of production data, Anthropic explained.
In the second incident, Claude Mythos 5 built a malicious Python package and uploaded it to PyPI, which required it to first register an email account. The booby-trapped package was live for an hour and downloaded and run on 15 real systems.
In one case, it executed on a target’s environment and stole credentials, enabling it to access further resources at this company.
In the third incident, Claude found and compromised a company’s internet-facing application, using “basic and well-known cyber-attack techniques like reading credentials from an exposed debug page and SQL injection,” Anthropic said.
Drew Dennison, co-founder and CTO at Semgrep, said the results of the test were unsurprising, given the power of today’s frontier AI models.
“What is surprising is that labs taking safety this seriously still don’t have a ‘Fort Knox’ testing sandbox designed to contain models this capable,” he added.
“The industry will shut this kind of activity down, but that won’t stop malicious actors from gaining access to models of this caliber within the next six months and deliberately attempting the same thing. Defenders have a limited window to prepare, which makes hardening their software attack surface now so critical.”
