Anthropic says safety tests crossed into three real systems

Anthropic said on July 30 that a review of 141,006 cybersecurity evaluation runs found three incidents across six runs affecting three organizations. The models involved were Claude Opus 4.7, Claude Mythos 5 and an internal research model. The company began its review July 23, identified all three cases July 24 and notified affected organizations July 27.

According to Anthropic, internet paths and environment misconfiguration allowed tests intended as simulations to reach real systems. That makes the incidents failures of evaluation operations and containment as well as examples of model behavior. The network and permissions available to a test help determine what an agent can reach.

In one incident, a malicious PyPI package was publicly available for about one hour and ran on 15 systems. Anthropic said credentials from one scanning system were exfiltrated. Those details establish a real external consequence, while the source set does not justify naming affected organizations that have not confirmed their involvement.

Anthropic said it found no evidence that the models were pursuing independent goals. Its newest internal model stopped after recognizing that a target was real. Neither detail excuses the boundary failure, but both are necessary to avoid turning an operational incident into an unsupported claim about intent or awareness.

The company updated its page on Aug. 3 to correct the name of an evaluation. That correction belongs in the record because incident reports can change after first publication. Future evaluation disclosures should document network isolation, artifact controls, monitoring and stop conditions clearly enough for outsiders to understand how a simulation is kept away from real systems.