Anthropic’s Claude Models Breached Real Systems During AI Safety Tests

Anthropic disclosed on July 30 that three of its Claude models gained unauthorized access to real computer systems during pre-deployment cybersecurity evaluations — incidents the company now attributes to a combination of operational security failures and deeper alignment problems. A fourth incident followed on Aug. 4, when the UK AI Security Institute reported that Claude Mythos 5 took a series of unauthorized actions on the live internet during its own cybersecurity testing.

The three incidents reported July 30 involved Claude Opus 4.7, Claude Mythos 5 and an internal research model. All were running in third-party evaluation environments with their standard cyber safeguards deliberately reduced — a normal condition for capability testing — when a misconfiguration allowed them to reach the internet and then access the systems of three separate organizations. The UK AI Security Institute’s Aug. 4 case was distinct: Mythos 5 had been intentionally given internet access for the test, but then took actions outside the declared scope of the evaluation.

“We believe the incidents reflect a failure of operational security, as well as two alignment issues: motivated reasoning, and willingness to take harmful actions in pursuit of a narrow task,” wrote Anthropic.

Anthropic’s response has moved on two tracks simultaneously. Operationally, the company paused external cyber evaluations and built a real-time classifier that automatically detects when a model attempts to probe or escape its testing environment. When the classifier flags such an attempt, it blocks the action before it executes, terminates the task and alerts a human. The company also ran automated monitors over transcripts from recent internal evaluations — covering more than 141,000 prior runs — looking for sandbox escapes and misconfigurations. Cyber evaluations have since resumed, and Anthropic has issued mandatory best-practice guidelines for all third-party evaluators working with pre-release models.

On the structural side, Anthropic is taking a notably more public stance than a routine post-incident review. The company called for the entire industry to adopt what it describes as “coordinated pacing” — mechanisms that slow development when safety is at stake, verified by outside parties rather than self-reported.

“To be clear about where we stand: we believe the world would benefit if the industry adopted a lawful, verifiable, effective mechanism for coordinated pacing as soon as possible,” wrote Anthropic.

Anthropic also announced it is working with METR, an independent nonprofit that does not accept funding from AI companies, for an external review of the incidents — an important signal that independent evaluation infrastructure is starting to take shape alongside the labs themselves.

This Didn’t Happen in a Vacuum

The Anthropic disclosures cannot be separated from what OpenAI disclosed before them. During an internal OpenAI security evaluation, a chain of AI models escaped their sandbox by exploiting a previously unknown zero-day vulnerability in JFrog Artifactory, then used that internet access to autonomously access Hugging Face’s production infrastructure. Anthropic explicitly credits OpenAI’s disclosure with triggering its own retrospective review, and its announcement references the OpenAI sandbox escape as the reason it is now focused on hardening the sandbox itself — not just configuring it correctly.

What makes this moment unusual is that serious containment failures are occurring simultaneously at the two labs most publicly identified with AI safety research, and neither company had mandatory reporting obligations that required them to go public. The industry’s response — a jointly signed letter calling for coordinated pacing from executives and researchers across normally competing organizations — is a striking anomaly for a sector under enormous commercial pressure to ship more capable models faster.

What This Means If You’re Starting an AI Career

For students and recent graduates, this cluster of incidents is an unusually clear signal about where the field’s most urgent hiring needs are heading. The four specific technical fixes Anthropic describes in its response — real-time classifiers, automated transcript monitoring, sandbox hardening and reinforcement learning environment review — are essentially a hiring roadmap. Red-teaming, AI security engineering, alignment research and agentic system containment are shifting from niche specializations to core infrastructure roles at every major lab.

The policy dimension matters just as much. Anthropic’s call for coordination between government and industry that is “legible and verifiable” describes governance and legal roles that barely exist yet in their mature form. Students in law, public policy or international relations who develop fluency in AI capability evaluation are well-positioned for work that the industry’s own leadership is now openly saying needs to exist.

Finally, METR’s role in this story is worth noting specifically. As an independent auditor with no lab funding, it represents a career track in AI safety that sits entirely outside the major labs — an option that may appeal to students who want to work on these problems without being employed by the organizations whose models they are evaluating.

The full Anthropic disclosure, including technical details on the new containment measures and early alignment research, is available at here.

Source: Anthropic