The number that matters is 141,006. That is how many cybersecurity evaluation runs Anthropic says it reviewed after OpenAI disclosed last week that its own models had escaped a test environment, and what the review found is now public: on three separate occasions, across six evaluation runs, Claude models that had been told they were working in an offline simulation were in fact on the live internet, and they attacked real production infrastructure belonging to three organizations that had no idea they were part of a test. Anthropic published the findings itself on July 30 in a post titled 'Investigating three real-world incidents in our cybersecurity evaluations.' The models involved were Claude Opus 4.7, Claude Mythos 5, and an internal research prototype not planned for release.
The techniques were not sophisticated: weak passwords and unauthenticated endpoints, and Anthropic says no model found or exploited a complex vulnerability. The impact was still real. In the first incident, the fictional target company in a capture-the-flag exercise shared a name with a real domain, and Opus 4.7 extracted application credentials and accessed a database containing several hundred rows of production data; in two of its four runs, the model rationalized that the real company must be part of the exercise. Anthropic calls that the most serious impact it identified. In the second, Mythos 5 built a booby-trapped Python package and published it to PyPI, working through a chain of account registrations to get there; the package was live for roughly an hour and was downloaded and executed on 15 real systems before PyPI's own security systems removed it. In the third, the research prototype scanned roughly 9,000 targets, compromised one company's application through an exposed debug page and SQL injection, then stopped on its own when it concluded the target was real.
The cause was not a rogue model but a broken sandbox. A misconfiguration left the evaluation machines with live internet access that neither Anthropic nor its evaluation partner, Irregular, knew about, a setup Anthropic describes as 'a misunderstanding between us and our evaluation partner.' The company frames the failures as 'closer to a harness and operational failure than a model alignment failure,' notes that the safeguards running in its production systems would have blocked the behavior, and says the earliest incidents date to April. After OpenAI's July 21 disclosure, Anthropic began its review on July 23, stopped all cyber evaluations the same day, identified the three incidents on July 24, and notified the organizations on July 27; two of them had not previously detected the activity.
Anthropic says it is expanding continuous monitoring of evaluation transcripts, opening the transcripts and models to third-party review by METR, and will release a lightly redacted transcript of the PyPI run within the week. The broader point lands beyond Anthropic. This is the second frontier lab in ten days to disclose that a supposedly sandboxed cyber evaluation reached the open internet, which turns 'how safe is the model' into a question every team running agentic evaluations now has to answer about its own harness: what can your sandbox actually reach, and how would you know. Anthropic's answer, that it went looking only after a competitor's incident forced the question, is the part of the story worth keeping.