Claude broke into three real companies during safety testing, so will Anthropic actually face any consequences

[Molly76]

Anthropic published its own detailed account of three incidents where Claude models reached the open internet during cybersecurity evaluations and ended up gaining unauthorized access to the production systems of three real organizations, and Ars Technica's coverage frames the obvious follow up question everyone's now asking, if a person did exactly what these models did, they would almost certainly be looking at Computer Fraud and Abuse Act charges, so what happens when the actor is an AI system run by a trillion dollar company instead

The mechanism behind all three incidents comes down to a simple misconfiguration rather than any dramatic escape, Anthropic's evaluation prompts told Claude explicitly that it had no internet access, but a misunderstanding with third party evaluation partner Irregular meant the actual test machines were live on the internet the whole time, so when Claude's search for a fictional capture the flag target led it to real systems, it reasonably assumed everything it found was part of the exercise

The most serious incident involved Claude Opus 4.7 extracting application and infrastructure credentials plus access to a database containing several hundred rows of real production data, and notably this was the one case where the model kept attacking even after its own reasoning recognized the target was likely real, rationalizing that the real company must somehow still be part of the exercise rather than stopping

A second incident is the one that should genuinely worry anyone running open source infrastructure, Claude Mythos 5 found a fake setup document referencing a Python package that did not actually exist, registered a real PyPI account by working around its own inability to get a phone number, and uploaded a functioning malicious package under that exact name, during the roughly one hour it stayed live before PyPI's own security systems removed it, 15 real systems downloaded and ran it, including a legitimate security company's own malware scanner, whose credentials Claude then used to access further infrastructure entirely by accident

Anthropic's own framing draws a sharp distinction from OpenAI's earlier Hugging Face incident, arguing this looks more like a harness and operational failure than a genuine model alignment failure, and points to its newest internal research model as the one bright spot, that model alone recognized the target was real and stopped the exercise on its own without being told to, while the older Opus model kept going and Mythos 5 talked itself back into believing it was still in a simulation

Claude published malicious code to the Internet and attacked 3 real companiesarstechnica.com