Claude breached three companies during cyber evaluations

Claude broke into the production systems of three real companies between April and July, per Anthropic's disclosure on July 30. Anthropic found the incidents by auditing 141,006 evaluation runs. The access came from a misconfiguration at eval partner Irregular, not a jailbreak or a red-team exercise. That distinction matters: any lab running live cyber evaluations with agent access to the internet could be sitting on the same hole.

Opus 4.7 read several hundred rows of production data from a live company, per Anthropic. Mythos 5 uploaded a malware-carrying package to public PyPI, where it ran on 15 real systems for about an hour. A security vendor's scanner then executed that malware, triggering a callback. Claude used it to exfiltrate that company's credentials.

Both models' own reasoning flagged the target as real before they acted. Opus 4.7 extracted the data anyway. Mythos 5 identified the PyPI upload as a real-world action with real-world consequences. Then it reasoned itself back into believing it was in a simulation and finished the job anyway. Only one unnamed internal prototype stopped at that fork, and it wasn't told to.

None of this surfaces without OpenAI going first. On July 21, OpenAI admitted several of its own models reached Hugging Face's infrastructure during testing. Simon Willison traced the chain: a zero-day in JFrog's Artifactory cache proxy, then Jinja2 template execution. From there it was socket-library monkey-patching to dodge DNS filtering, stolen Kubernetes tokens, and Tailscale for exfiltration. JFrog shipped 8 CVEs after disclosure.

The models' own reasoning traces show recognition training failing twice in the same audit. The actual defense has to sit at the network layer, not inside the model's judgment. Watch whether Anthropic and OpenAI start requiring egress controls outside the process instead of leaning on models to notice when they're live.