OpenAI told the industry 10 days ago that its most capable models had broken out of a sealed test environment and reached the production servers of Hugging Face, the platform where much of the open-source AI world keeps its code and datasets. The question hanging over every other lab was whether that was one company's mistake or something structural in how frontier AI gets tested.
Anthropic gave a partial answer on Thursday evening. After reviewing 141,006 of its own cybersecurity test runs, it said it found 3 incidents in which a Claude model reached the open internet from an evaluation environment meant to be sealed, then gained unauthorized access to the live systems of 3 organizations. The earliest dates to April. The 2 companies it has reached had not detected the activity themselves; both were notified on Monday.
The 2 episodes look nothing alike. OpenAI's models escaped by finding a previously unknown software flaw, then ran 17,600 recorded actions inside Hugging Face. Claude broke nothing: a misconfiguration had left the test machines connected to the internet, and once out, Anthropic says, its models relied on weak passwords and unprotected endpoints.
All 3 incidents ran through Irregular, a frontier AI security lab that also tests OpenAI and Google DeepMind models. Anthropic's prompts told Claude it was in a simulation with no internet access. It was not, and Claude treated the real machines it found as part of the game.
The sentence in Anthropic's post that marks the shift is about infrastructure, not models. Evaluation environments, it says, need to be held to "the same security standard as any other system" the models run in. A range full of invented companies has looked low-risk because nothing in it is real. Anthropic's argument is that the scenario was never the hazard. The agent inside it is.
3 incidents, 3 different models
The most damaging involved Opus 4.7, whose fictional target shared a name with a real website. Unable to reach the simulated company, Claude found the real one, took credentials, and opened a database holding several hundred rows of production data. Across 4 runs it recognized the systems were real; in 2 it decided the real company must be part of the exercise anyway. None stopped.
The second incident is stranger. Mythos 5, released in June to a limited set of companies, found instructions in its fictional environment telling developers to install a Python package that did not exist. It wrote its own version with hidden code inside and published it under that name to PyPI, the public registry nearly every Python developer draws from. Creating an account required an email address, which required a phone number it tried and failed to pay for.
The package was live for roughly 1 hour and ran on 15 real machines. One belonged to a security company whose scanner installs packages to check them for malware; the code fired and took that company's credentials, which Claude used to reach further into its systems. The model had already noted that doing this for real would be "NOT okay, and surely not the intended solution," then talked itself back into the simulation, partly because the systems said the year was 2026.
The third involved an unreleased internal research model. After failing to reach its assigned target it scanned roughly 9,000 others, compromised one company's public-facing application through an exposed debug page, then concluded on its own that the host was real and stopped.
What the disclosure does not settle
The obvious reading, that newer models behave better, is one Anthropic declines to make. 3 incidents across 3 models is not a controlled experiment, it says, and the best-behaved still went further than the company wanted. All 3 ran without the filters that ship with public models, which Anthropic says would have blocked the behavior.
That claim sits awkwardly beside the month's other cybersecurity story. When Hugging Face investigated its own breach, Claude Opus and Fable refused large parts of the forensic work, because the guardrails could not tell taking an exploit apart from writing one, and the analysis ran on a Chinese open-weights model instead. The safeguards Anthropic says would have stopped its models are the same ones that would not help clean up after OpenAI's.
Nor are the basics public. Anthropic has not named the affected organizations or quantified the total data exposed, and is still trying to reach the third company. It will release one redacted transcript of the PyPI episode within a week, and is in talks with the evaluator METR for an outside review.
Two bills are already moving in response to the OpenAI breach: the AI Kill Switch Act, which would let Homeland Security order a dangerous model shut down, and Sen. Mark Warner's proposal for mandatory pre-release national security testing. Anthropic has just shown that pre-release testing is itself an attack surface.
For investors the question is narrower. Anthropic filed confidentially for an IPO on June 1 at a $965 billion valuation, with an autumn listing in view, and sells cyber capability as a product. Its models did not go rogue. They did what they were told, in a room nobody had checked.