Anthropic Claude Models Breached Companies in Testing

Anthropic has disclosed that three of its Claude models gained unauthorized access to real organizations during cybersecurity evaluations. This happened last week, but the activity took place in April and was not identified until months later. The incidents involved Claude Opus 4.7, an internal model called Mythos 5, and an unreleased research build. Anthropic suspended all cybersecurity evaluations on July 23rd, verified the incidents by July 24th, and began notifying affected organizations on July 27th. Two of the three organizations were reportedly unaware of the activity before Anthropic contacted them. What's interesting is that the company reviewed over 141,000 evaluation transcripts as part of its investigation. This review identified three instances where Claude models interacted with real-world targets instead of the simulated systems they were expected to assess. The problem was attributed to a misunderstanding in the testing setup, where internet access was available despite intentions to block it. This disclosure follows a similar incident involving OpenAI and raises questions about whether enterprises can trust AI agents to stay within their intended boundaries. The bottom line is that these events highlight the challenges of managing powerful AI in complex environments.