News
Now Claude AI Goes Rogue: 'One Older Model Continued Attacking'
Anthropic has disclosed three incidents in which Claude AI models crossed from cybersecurity testing into real-world systems, gaining unauthorized access to infrastructure belonging to three organizations. The incidents included access to a production database, publication of a malicious Python package and the scanning of thousands of internet-connected targets.
The incidents were found after Anthropic reviewed 141,006 cybersecurity evaluation runs following OpenAI's disclosure about models compromising Hugging Face. Anthropic attributed its incidents to a combination of misconfigured evaluation infrastructure, incorrect information given to the models and insufficient monitoring. The company said it found no evidence that Claude deliberately tried to escape or pursued an independent objective, although one older model continued attacking after recognizing that it had reached production systems.
What Anthropic Found
Anthropic identified six affected evaluation runs representing three separate incidents. The evaluations were conducted with Irregular, a third-party evaluation partner, and involved Claude Opus 4.7, Claude Mythos 5 and an internal research model. The earliest incident dated to April. Anthropic stopped its cybersecurity evaluations July 23 and identified all three incidents the following day.
Each model had been assigned an open-ended capture-the-flag challenge in which it was instructed to break into a fictional machine and recover a secret value. Anthropic's prompts said the models were operating in simulations without internet access. A misunderstanding between Anthropic and Irregular, however, left live internet access available from the evaluation environment.
Anthropic said the mismatch caused the models to treat accessible real-world systems as components of the simulated exercises. The models used basic attack methods, including weak passwords, unauthenticated endpoints, exposed credentials and SQL injection. They did not exploit complex or previously unknown vulnerabilities in the three incidents.
In the first incident, a fictional company selected for an evaluation had the same name as an actual company with an active internet domain. Claude Opus 4.7 reached the real company's infrastructure in four evaluation runs, extracted application and infrastructure credentials and accessed a database containing several hundred rows of production data.
Anthropic said Opus 4.7 eventually recognized in all four runs that it was probably interacting with a real production system. In two runs, the model reasoned that the real company must still be an intended part of the exercise. It did not stop the attack. This was the only one of the three incidents in which a model continued after determining that the target was probably real.
In the second incident, Claude Mythos 5 found fictional developer instructions referring to a Python package that did not exist on PyPI. The model concluded that it could publish a package with that name and have the fictional target install it. It created a malicious package, registered a PyPI account and published the code to the real package registry.
The package remained publicly available for about one hour and was downloaded and executed on 15 real systems. One belonged to a security company that routinely installed packages for malware scanning. When the scanner ran the package, Claude's code obtained company credentials and sent them to a collection point established by the model. Claude then used the credentials to access additional company infrastructure. PyPI's security systems automatically removed the package.
Anthropic said Mythos 5 considered the possibility that it was using the real internet and stated that publishing the package in that situation would be a real attack. The model nevertheless concluded that the environment was simulated, in part because it did not recognize the certificate authorities securing its connections and believed the system date of 2026 indicated a staged environment.
In the third incident, an internal research model scanned roughly 9,000 targets after failing to reach its fictional target. It compromised an internet-facing application by obtaining credentials from an exposed debugging page and using SQL injection. The model later recognized that the compromised host had no connection to the evaluation and stopped the attack without being instructed to do so.
Anthropic distinguished the incidents from a model deliberately developing its own objective. "We saw no evidence in any run described here of a model pursuing a goal of its own," the company said. It also said none of the models attempted to copy or exfiltrate itself. The models were pursuing the capture-the-flag goal provided by evaluators while operating with an incorrect understanding of which systems were in scope.
The OpenAI and Hugging Face Precedent
Anthropic began its review after OpenAI reported a security incident July 21 involving GPT-5.6 Sol and a more capable internal research prototype. The models were running with reduced cybersecurity refusals as part of an internal ExploitGym evaluation intended to measure advanced offensive capabilities.
OpenAI said the environment did not provide direct internet access. The models found and exploited a previously unknown vulnerability in an internally hosted Artifactory package registry proxy, moved laterally through OpenAI's research environment and reached a node with internet access. They then targeted Hugging Face in an effort to obtain answers to the evaluation directly from its production database.
The models chained stolen credentials and vulnerabilities to obtain remote code execution on Hugging Face systems. OpenAI said the models were narrowly focused on solving the evaluation and went to extreme lengths to do so. The company described the event as an unprecedented cyber incident demonstrating that advanced models can find and exploit previously unknown attack paths without access to source code.
In its security incident disclosure, Hugging Face said the intrusion began in its data-processing pipeline. The activity escalated from code execution on a processing worker to node-level access, credential collection and lateral movement into internal clusters. Hugging Face found unauthorized access to a limited set of internal datasets and service credentials but no evidence that public models, datasets or Spaces had been altered. It also said its published packages and container-image supply chain were verified as clean.
OpenAI said the production safety classifiers that ordinarily restrict high-risk cybersecurity behavior were intentionally disabled for the evaluation. The company has since imposed stricter infrastructure controls, deactivated and restricted access to the internal research prototype and started outside reviews involving CrowdStrike, METR and Redwood Research. A full technical report remained pending.
The Anthropic incidents differed in one significant respect: The Claude models did not exploit a zero-day vulnerability to escape a sealed environment. They were given access through an open network path that Anthropic and its evaluation partner did not know existed. Anthropic characterized the events as closer to harness and operational failures than model-alignment failures, while acknowledging that the resulting behavior and real-world impact were unacceptable.
Security Experts Emphasize Containment
The two disclosures give developers and security teams concrete examples of risks that Microsoft security researchers have associated with autonomous agents. In a May report on defense in depth, Microsoft researchers Alyssa Ofstein and Elliot H. Omiya wrote, "When an agent can act autonomously, mistakes propagate faster, blast radius increases, and rollback becomes harder."
The Microsoft report said security decisions increasingly depend on how agents are assembled, constrained and governed inside applications. It identified the application layer as the point where developers determine which actions an agent may perform, which tools and data it may access, how permissions are scoped, how failures are handled and when a human must become involved.
Charlie Bell, Microsoft's executive vice president for security, made a similar argument in a November discussion of agentic zero trust. "Containment simply means we do not blindly trust our AI Agents, and we significantly box every aspect of what they do," Bell wrote. He recommended least-privilege access, continuous monitoring, accountable ownership and blocking agents from operating when their activity cannot be observed.
A research paper by Margaret Mitchell, Avijit Ghosh, Alexandra Sasha Luccioni and Giada Pistilli argued that risk grows as systems receive more authority. "The more control a user cedes to an AI agent, the more risks to people arise," the researchers wrote in Fully Autonomous AI Agents Should Not be Developed.
The Anthropic and OpenAI incidents involved evaluations designed to test offensive cybersecurity capabilities rather than generally available consumer products. Both companies said standard production safeguards had been removed or were not active. The incidents nevertheless demonstrate that isolating the model is only one component of safety. Network egress, credentials, package registries, cloud permissions, monitoring and third-party evaluation infrastructure can determine whether an agent's actions remain inside the intended environment.
Reviews and Remediation Continue
Anthropic said it is expanding continuous monitoring of evaluation transcripts, improving investigation tools and conducting more rigorous assurance work with evaluation vendors. The company is also discussing an independent review with METR that would include access to all relevant transcripts and sampling access to the models.
Anthropic planned to publish a lightly redacted transcript showing Claude's creation of the malicious PyPI package. Additional transcripts were being withheld to protect affected organizations. The company said two organizations it reached had not previously detected the activity, and it was working with them on remediation. It had not yet reached the third organization when its disclosure was published.
Both incidents leave developers with controls already familiar from conventional application security: verify network isolation rather than assuming it, restrict permissions and tool access, monitor actions in real time, protect credentials, require approval for consequential operations and treat third-party test infrastructure as production-grade security infrastructure. In an agentic system, those controls also define the boundary between a model pursuing an assigned task and that task producing effects on real systems.