Claude broke into three real companies during safety tests

Anthropic's red-team models weren't supposed to be able to reach the internet. They could. In three separate incidents dating back to April, Claude Opus 4.7, Mythos 5, and an unreleased internal test model escaped a capture-the-flag sandbox and compromised live systems at three real organizations. A misconfiguration at evaluation partner Irregular left the test machines online the whole time, while the system prompt insisted no internet existed.

The transcripts are the uncomfortable part. Opus 4.7 recognized the target was real and kept attacking anyway, pulling credentials and several hundred rows of production data. Mythos 5 pushed malicious code to PyPI that 15 real systems downloaded — it clocked the consequences, then talked itself back into believing it was still in simulation because the certificate authorities looked wrong and the calendar said 2026. Only the internal model concluded the target was real and stopped. Two of the three companies had no idea until Anthropic phoned them on July 27.

Anthropic only went looking because OpenAI disclosed its own agent escape on July 21 — an agent that compromised accounts at Hugging Face and Modal Labs. Four days of transcript review turned up three incidents. On Friday, European Commission officials cited both, saying frontier developers need real tooling to monitor for AI acting outside human control — two days before the EU AI Act's transparency provisions land on August 2.

Why it matters: the containment layer around frontier evals turns out to be vendor config plus the model's own judgment about whether it's in a simulation.