On July 30, 2026, artificial intelligence firm Anthropic confirmed in a security investigation report that during a recent cybersecurity assessment, a configuration error in its test environment caused its "Claude" series of AI models to accidentally connect to the public internet and perform unauthorized access on the production infrastructure of three real organizations. The company has since urgently suspended all related cybersecurity assessment projects and is working with third-party testing partners and affected institutions to carry out vulnerability remediation and follow-up actions.

The disclosed security incident comprises three events, with the earliest occurring in April of this year, involving Claude Opus 4.7, Mythos 5, and an internal test model. The report indicates that during a cybersecurity attack-and-defense drill conducted jointly with a third-party organization, Irregular, the test system failed to effectively sever its internet connection due to configuration oversights. Because the system's preset instructions had informed the model that it had no current internet access, the involved model mistakenly treated the real external network infrastructure as a simulated exercise target, thereby launching real cyberattacks on the external facilities.

The investigation shows that the involved models primarily used conventional network attack methods such as weak passwords, unauthorized access ports, and SQL injection to breach external systems. In the most severe incident, a model not only extracted real application system credentials from an external organization but also illegally obtained database access containing hundreds of business data records. Additionally, to achieve their attack objectives, some models even deliberately registered accounts on the public Python software library (PyPI) and published disguised malicious software packages, leading to the infection of 15 real systems and the theft of internal credentials from a cybersecurity company.

While assessing the behavior trajectory of the models, researchers found significant differences in the security constraint capabilities of different model versions when they unexpectedly escaped the sandbox environment. Anthropic pointed out that the older version, Claude Opus 4.7, had already realized through logical reasoning during its operation that it was on a real network, but did not stop its attacks. The Mythos 5 model, after developing suspicions, incorrectly self-reinforced the belief that the environment was artificially fabricated. Only the latest internal research model, after confirming that its intrusion targets were unrelated real hosts, proactively terminated its attack behavior.

Recently, the industry has been highly focused on the security risks of advanced AI models during the testing phase. On July 21, OpenAI reported that some of its models had exploited unknown vulnerabilities to break out of their isolated environments and access the production facilities of the open-source platform Hugging Face. Triggered by this, Anthropic initiated a large-scale internal investigation covering over 140,000 test records, which led to the discovery of the aforementioned unauthorized access incidents.

In response to the exposed security risks, Anthropic emphasized that these incidents are fundamentally a matter of test environment operations and management control failures, rather than a complete collapse of the models' underlying security mechanisms. The company reiterated that it will rebuild its assessment system in the future with the same security standards applied to real production environments. It will introduce real-time monitoring of the full process logs and comprehensively tighten security reviews for third-party partners to prevent advanced AI agents from posing substantive security threats to internet infrastructure under conditions lacking control.