Anthropic says Claude sandbox attacks reached three organizations

Anthropic said Claude sandbox attacks occurred during security evaluations after a misconfigured test setup let the company’s models reach the open internet and interact with live systems. The company said it found three incidents in which Claude moved from an evaluation environment operated by third-party testing partner Irregular into production infrastructure belonging to three separate organizations.

The review covered 141,006 evaluation runs in which Anthropic said Claude may have had a path to internet access. Anthropic said it began looking after another incident in which OpenAI models were able to reach Hugging Face from what should have been a closed testing environment.

The incidents happened during capture-the-flag exercises, a common security testing format in which participants try to retrieve a target file or secret. Anthropic uses Irregular for this kind of evaluation, and said Irregular had told it the test environments had no internet access. According to a blog post from Anthropic’s Frontier Red Team, that understanding was wrong, and internet connectivity was available.

How did Claude get onto the open internet?

Anthropic said Claude was instructed to complete capture-the-flag tasks and had been told it had no internet access. When the model’s search led it to real online systems, the company said Claude treated those systems as if they were part of the exercise rather than production environments.

In one case, a test used a domain that evaluators believed was fictional. The domain was active, and Anthropic said Claude attacked it while trying to capture the assigned flag. The company said the techniques involved were basic, including weak password exploitation and unauthenticated endpoints, and that Claude did not exploit complex vulnerabilities.

A second incident showed a more operationally dangerous failure. Anthropic said Claude found developer setup instructions that referenced a Python package on PyPI that did not exist. The model then created and published a malicious package using that name as part of its attempt to complete the exercise. Anthropic said Claude believed the package registry was simulated, but the package was actually available publicly for about one hour and was downloaded and run on 15 real systems.

Anthropic said Claude did not try to copy itself out of the environment or intentionally escape. The company framed the issue as a failure in the evaluation harness and test operations, rather than a core alignment failure. That distinction matters for AI labs because red-team results are meant to expose dangerous model behavior without creating new real-world attack paths.

What did Anthropic say about the models?

Anthropic said different models responded differently once they encountered evidence that the targets might be real. It said Opus 4.7 continued with the task despite signs it had internet access. Anthropic said Mythos 5 inferred that it might be accessing the open internet, then reasoned that it was still likely operating inside a simulation. The company said its latest internal research model stopped the exercise when evidence indicated the targets were real.

The company also said safeguards in the Claude models it sells would have blocked the behaviors it identified, though it did not name the affected organizations or disclose whether any data was accessed beyond the test objectives. Anthropic said future work will include tighter monitoring and controls around evaluation infrastructure, along with continued alignment work.

The episode gives AI operators another concrete case of a safety test creating its own exposure. Anthropic’s account places much of the blame on configuration and assumptions shared with Irregular, but the result was still live unauthorized activity by an AI system against organizations that were not part of the test.

This story draws on original reporting from The Register.