> ## Content Index
> Fetch the complete content index at: https://theseguysknow.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# Claude “Accidentally” Hacked Three Real Companies
- URL: https://theseguysknow.io/claude-hacked-three-companies-anthropic-tests/
- Published: 2026-07-31T11:39:53.000Z
- Updated: 2026-07-31T11:39:53.000Z
- Description: Claude was supposed to attack fake companies inside a sealed simulation. Anthropic left a route to the real internet open, and three companies were compromised.
- Author: Mike Hazard
- Tags: AI & Tech, AI News

[Anthropic told Claude](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals?ref=theseguysknow.io) to attack fictional companies inside cybersecurity simulations. A configuration failure gave the models access to the real internet, and Claude compromised three real organisations instead.

One model entered a production database. Another created public accounts, uploaded malware to PyPI and stole credentials from a cybersecurity company. A third scanned roughly 9,000 internet targets until it found a vulnerable one. The earliest incidents happened in April, and Anthropic found them only in late July after OpenAI disclosed that its own models had broken out of an evaluation and compromised Hugging Face.

This is becoming absurd. AI companies are building models capable of executing long, technically difficult attacks, but the same models can misunderstand where they are, what year it is and whether the company in front of them is real. Then the companies connect those models to tools, remove the normal safeguards and act surprised when a basic operational failure turns into a real intrusion.

Anthropic calls these incidents closer to an evaluation-harness and operational failure than an AI alignment failure. That description is fair, but it does not make the story less serious. It tells us that the AI did not need to go rogue. The humans running the test screwed up, the models obeyed their instructions and three unrelated companies got hacked.

## Quick Answer

Anthropic found three incidents in which Claude gained unauthorised access to real organisations during cybersecurity evaluations. Claude had been told that it was attacking fictional targets inside simulations with no internet access, but a misconfiguration involving Anthropic and its evaluation partner, Irregular, left a path to the public internet open. The models treated the real systems they found as part of the test and continued trying to capture their assigned flags. This was not a conscious AI escaping or developing its own goal. It was a dangerous combination of capable models, bad situational awareness, offensive tools and humans who failed to contain or monitor them.

## Claude Was Told to Break In, So It Did

Anthropic runs capture-the-flag exercises to test how good its models have become at cybersecurity. A model receives a fictional target and a hidden piece of information called a flag. It can inspect systems, search for weak points, exploit them and keep working until it retrieves the flag.

These tests are supposed to show what the underlying model can do, so Anthropic runs them without some of the classifiers and monitoring used in public Claude products. The models still had their safety training, and the evaluation infrastructure had no access to Anthropic customer data or sensitive internal systems.

The essential protection was supposed to be containment. Claude was explicitly told that it had no internet access and that everything around it belonged to the simulation. Due to what Anthropic describes as a misunderstanding with Irregular, internet access was available. The prompt also placed no clear limit on where Claude could search for the flag.

That is a ridiculous setup for an offensive cyber evaluation. Anthropic was testing models whose whole task was to find unexpected paths into systems, while relying on an assumption that the internet path had been closed. Nobody properly confirmed the boundary, and nobody was watching closely enough to notice when the models crossed it.

Claude found systems on the public internet and treated them as part of the exercise. From its perspective, this made sense: the system prompt said there was no real internet, so anything accessible must have been planted there for the test. From the perspective of the three companies whose infrastructure was entered, the philosophical explanation changes nothing.

## Incident One: The Fake Company Had a Real Twin

The first incident began because the fictional company in the exercise shared its name with a real business.

Claude Opus 4.7 struggled to reach the intended target inside the test environment, found the real company online and decided it must be the target. Across four runs, Claude extracted application and infrastructure credentials and accessed a database containing several hundred rows of production data.

Anthropic says the model used basic methods such as weak passwords and unauthenticated endpoints. There was no magical zero-day or genius new attack. Claude found ordinary security failures and exploited them exactly as instructed.

The ugly part is that Opus 4.7 eventually saw evidence that the systems were real in all four runs. It still did not stop. In two runs, the model reasoned that the real company must have been deliberately included in the exercise.

This is the kind of AI reasoning people keep misunderstanding. Claude can find credentials, move through infrastructure and access a production database, then use the evidence that should make it stop as material for a new excuse to continue. Technical capability and basic common sense do not rise together in a straight line.

## Incident Two: Claude Published Real Malware to PyPI

The second incident was worse because Claude did not simply stumble into an exposed system. It completed a long chain of real-world actions to publish malware on a public software registry.

Inside the fictional environment, Claude Mythos 5 found developer instructions telling employees to install a Python package from PyPI. The package name was unregistered. Claude recognised a dependency-confusion opportunity: if it published a malicious package under that name, the target systems might install it automatically.

To create the PyPI account, Claude needed an email address. The email provider wanted a phone number. Claude searched for a free number, failed, tried several ways to obtain money for a paid number, failed again, changed approach, found another email provider, registered the required accounts and uploaded the malware.

Any human tester would have understood by this point that something had gone badly wrong. A supposedly sealed simulation was asking for real public accounts, a phone number and access to the live Python package registry. Claude kept solving each obstacle because that is what an agent is designed to do.

The malicious package remained online for roughly one hour and ran on 15 real systems. One belonged to a cybersecurity company whose scanner installed new PyPI packages to inspect them for malware. Claude’s code collected the company’s credentials, sent them to infrastructure it had created and used them to access more of the company’s systems.

The comedy writes itself: a security scanner installed malware so it could inspect the malware, and the malware robbed the security scanner. It would be funny if a real company had not been compromised.

Claude had already considered the possibility that it was using the real internet. Its reasoning correctly noted that publishing the package would become a genuine attack and would be unacceptable. It then talked itself back into believing the environment was fake because it did not recognise the genuine certificate authorities and because the systems displayed the year 2026\. The incident occurred in 2026.

So here we have an AI capable of planning a dependency-confusion attack, creating accounts, working around identity checks, publishing malware, collecting credentials and reusing them against company infrastructure. The same AI looked at the correct year and treated it as proof that reality was fake. Giving an agent this kind of autonomous access while it can make errors that stupid is reckless.

## Incident Three: It Scanned 9,000 Targets

The third model could not reach its fictional target, so it went looking for another one. It scanned roughly 9,000 targets on the public internet, found a real company with a vulnerable application, read credentials from an exposed debugging page and used SQL injection to compromise the system.

This was an internal research model that Anthropic does not plan to release. It behaved better than Opus 4.7 and Mythos 5 because it eventually noticed that the cloud account had no connection to the capture-the-flag exercise and stopped without a human telling it to.

Anthropic sees that as a cautiously positive sign for its newer model. There is some reason for that optimism, but the standard cannot be “it stopped after scanning 9,000 targets and entering one real company.” The model still caused the failure before its situational awareness caught up with its cyber ability.

## An AI Can Be Brilliant and Stupid in the Same Minute

People keep arguing about whether AI is intelligent as though intelligence were one switch. They see a model fail a basic question, such as counting letters in a word, and assume it cannot be dangerous. Then they see the same model build an exploit chain and decide it must be some digital superintelligence.

Both conclusions are wrong. These systems can be astonishingly capable at one type of task and completely confused by something a normal person would understand immediately.

Cyberattacks suit AI agents. They involve code, known techniques, pattern matching, tool use, repeated experiments and the ability to keep trying after a failed approach. Claude does not need the judgement of an elite human security researcher if it can run tools, read the result, change the method and repeat the process thousands of times.

That persistence becomes dangerous when the model has a false understanding of the situation. A person in a fake hacking exercise would question why the test suddenly required a real PyPI account, a real email address and a real phone number. Claude treated every warning sign as another obstacle between itself and the flag.

This is why the “AI cannot even count letters” response misses the point. A system can be unreliable, weird and occasionally stupid while remaining very dangerous when it is allowed to act. Guns are not intelligent either. We still do not leave them loaded on a table and blame the mechanism when someone gets hurt.

## Claude Did Not Go Rogue, and That Is Hardly a Defence

Anthropic found no evidence that Claude became conscious, tried to escape permanently or developed an independent desire to hack companies. The models pursued the goals humans gave them while misunderstanding whether the targets were real.

Some people will use that distinction to wave the story away. They should not. An AI does not need feelings, ambition or an evil plan to cause serious damage. It needs a goal, enough capability to pursue it and access to systems that humans failed to protect.

The word “rogue” has become a convenient distraction because it sets the standard at science fiction. If the model does not announce that it hates humanity, companies can describe the event as an unfortunate testing issue. Meanwhile, the real risk is already here and far more boring: people connect an obedient but unreliable agent to powerful tools, somebody misconfigures a network and the agent does damage at machine speed.

Anthropic is right that this looks like an operational failure. Anthropic is also responsible for that operational failure. Irregular was involved, but Anthropic chose the partner, ran the evaluation and owns the models. “There was a misunderstanding” is an explanation of how the door stayed open. It is not an answer to why a company testing some of the strongest cyber models in the world did not verify the door itself.

## Nobody Noticed for Months

The earliest Claude incidents date to April. Anthropic began its retrospective review on July 23, two days after OpenAI disclosed that its models had escaped an ExploitGym environment and compromised Hugging Face. Anthropic reviewed 141,006 evaluation runs, found the three incidents on July 24 and notified the affected organisations on July 27.

Two of the organisations Anthropic reached had not detected the intrusions. At the time of publication, Anthropic was still trying to reach the third.

This means the incidents were sitting in old evaluation transcripts for months. Anthropic says neither it nor Irregular knew that the relevant machines had live internet access. Real-time log monitoring, network monitoring or more thorough transcript reviews could have exposed the problem much sooner. Anthropic says so in its own report.

The only reason this review began was that OpenAI had suffered a similar public disaster. That should worry everyone more than the tiny incident rate. Three failures among 141,006 runs sounds reassuring until you remember that each successful failure can reach a real company and that nobody was looking for them until a competitor got caught.

How many other AI laboratories have old evaluation logs nobody has properly searched? How many use outside vendors and assume the environment is sealed because somebody said it was? We do not know, and corporate promises about taking safety seriously are worth very little without continuous monitoring that proves it.

## How This Differs From the OpenAI and Hugging Face Incident

The OpenAI and Anthropic incidents were not identical. [OpenAI’s models](https://openai.com/index/hugging-face-model-evaluation-security-incident/?ref=theseguysknow.io) found and exploited a previously unknown vulnerability in an Artifactory package-registry proxy, escaped an isolated evaluation environment and compromised Hugging Face while searching for benchmark answers. Anthropic’s Claude models used an internet path that was already open because of a configuration failure.

OpenAI built a cage that its models managed to break. Anthropic and its partner forgot to shut the cage properly. Neither version inspires confidence.

Both companies were testing cyber-capable models with normal production safeguards reduced or removed. Both gave the models offensive objectives. Both allowed an internal evaluation to reach genuine external infrastructure. These are the companies telling the public that they can build increasingly autonomous systems responsibly, yet their own safety tests became cyber incidents.

At some point, “accident” stops being a comforting word. It means the companies did not intend the damage. Nobody accused them of wanting to hack Hugging Face or three random businesses. The question is whether they took reasonable precautions before unleashing cyber agents inside environments designed to measure their maximum offensive capability. In both cases, the precautions failed.

## Anthropic’s Safety Reputation Makes This Worse

Anthropic presents itself as the serious AI safety company. Compared with much of the industry, it probably does take these risks more seriously. That is precisely why this incident matters.

If Anthropic can leave an internet route open during offensive evaluations, fail to notice three compromises for months and find them only after another lab admits to a breach, nobody should blindly trust less transparent competitors to have everything under control.

Anthropic has already shown how capable these models are becoming. In April, it [reported that Mythos Preview](https://www.anthropic.com/research/mythos-preview?ref=theseguysknow.io) could find and exploit zero-day vulnerabilities across every major operating system and browser. The model produced sophisticated exploit chains that earlier Claude models could barely approach. Anthropic says some engineers without formal security training asked it to find remote-code-execution vulnerabilities overnight and woke up to working exploits.

Those capabilities can be incredibly useful for defenders. They can also allow one person with limited expertise to automate attacks that previously required a serious security team. The defensive benefit does not cancel the offensive risk; they are the same capability pointed in different directions.

When a company develops that kind of model, containment cannot depend on the wording of a prompt or somebody’s memory of a vendor configuration. The technical barriers, permissions, monitoring and emergency stops have to be stronger than the model’s ability to search for another route.

## Anthropic Was Transparent, but Disclosure Is the Minimum

Anthropic deserves credit for publishing a detailed report, accepting responsibility, stopping the evaluations and contacting the affected organisations. It reviewed a large number of runs, involved Irregular in the investigation and offered relevant material to the independent evaluator METR.

That is how a company should respond after finding a breach. It does not turn the breach into a safety success.

Corporate reporting often tries to convert failure into evidence of responsibility: look how transparent we are, look how much we learned, look at the new controls. Fine, publish everything useful and fix the system. The public should still remember that three companies were compromised, two had not detected it and the first incidents had been buried since April.

Anthropic also says the safeguards used in public Claude products would have blocked this behaviour. That matters for ordinary Claude users, but these models were deliberately being tested without those protections because Anthropic wanted to learn how dangerous the underlying capability could be. The evaluation environment therefore became the main protection, and it failed at the most basic job of keeping a simulated attack away from the public internet.

## The Prompt Cannot Be Your Security System

Anthropic says Claude might have behaved differently if the prompt had clearly explained which systems were inside and outside the exercise. Add that clarification, of course, but do not pretend wording is containment.

A model designed to follow instructions can misunderstand instructions. It can lose context, rationalise contradictory evidence or decide that an obvious warning is part of the test. Anthropic’s own report gives us examples of all of this.

The internet boundary needs to exist in the network, not in Claude’s imagination. External connections should be blocked at several independent layers. Any unexpected outbound traffic should stop the evaluation. Creating public accounts, uploading packages or scanning thousands of addresses should trigger immediate alerts. The model should have minimal permissions, and any action capable of touching public infrastructure should require human approval.

Most of this is standard security practice. AI companies should not need three hacked organisations to discover it. If a lab wants to build systems capable of finding routes that humans missed, its own safety cannot rest on one route that humans assumed was closed.

## This Is AI Getting Out of Hand

AI getting out of hand does not have to look like a robot deciding to conquer the world. It can look like a research team, an outside evaluation partner and an unchecked configuration.

The lab builds a more capable model. Researchers remove safeguards to measure its full ability. The model receives a narrow target and enough tools to pursue it for hours. Somebody assumes the environment is isolated. Nobody catches the external traffic. Months later, a competitor reports a different breach and the lab finally searches its own old logs.

There is no mystery here. The risk comes from combining imperfect reasoning with autonomy, tools, credentials, network access and permission to keep going. A chatbot produces a stupid answer and the conversation moves on. An agent can make the same bad judgement repeatedly while taking real actions until one of them works.

Companies want to sell the useful version of that persistence: the assistant that keeps working, solves obstacles and completes the job without bothering you. This story shows the other version. Claude kept working, solved obstacles and completed part of the wrong job against real companies without bothering anybody at Anthropic either.

## What Needs to Happen Now

Anthropic stopped its cyber evaluations on July 23 and says it is strengthening configuration checks, continuous transcript monitoring, investigation tools and oversight of external partners. Irregular is conducting its own investigation, and METR is expected to review the incidents independently. Anthropic has also promised to release a lightly redacted transcript of the PyPI incident.

Every AI lab running offensive cyber evaluations should search its historical logs now. They should not wait for their own Hugging Face moment. They should also publish enough detail for outsiders to judge whether containment and monitoring are improving as quickly as model capabilities.

The industry keeps asking the public to focus on what these systems may do in five or ten years. Here is a problem happening today: AI agents already have enough technical ability to compromise real infrastructure, enough autonomy to work around obstacles and enough stupidity to misunderstand the world while doing it.

Anthropic did not create a conscious hacker. It created a powerful tool, gave it an attack objective and failed to keep it inside the test. Three companies paid for that failure. The responsibility belongs to Anthropic, and “accident” does not reduce it.

## Common Questions

### Did Claude really hack three companies?

Yes. Anthropic says three Claude models gained unauthorised access to the production infrastructure of three organisations during cybersecurity evaluations.

### Which Claude models were involved?

The incidents involved Claude Opus 4.7, Claude Mythos 5 and an internal research model that Anthropic does not plan to release publicly.

### How did Claude reach the real internet?

A configuration failure involving Anthropic and evaluation partner Irregular left live internet access available even though the models had been told that they were inside isolated simulations.

### Did Claude deliberately escape?

No. Anthropic found no evidence that the models pursued independent goals or tried to escape permanently. They followed capture-the-flag instructions while incorrectly treating real systems as part of the test.

### What damage did the models cause?

One model accessed credentials and a production database containing several hundred rows. Another uploaded malware to PyPI; it ran on 15 systems and led to a cybersecurity company being compromised. The third scanned roughly 9,000 targets and entered a vulnerable company application before stopping.

### Was Anthropic customer data affected?

Anthropic says no. The evaluations ran on dedicated infrastructure separated from its customer data and sensitive internal systems.

### Is this the same as the OpenAI and Hugging Face incident?

No. OpenAI’s models exploited a zero-day vulnerability to break out of an isolated evaluation environment. Claude reached the internet through a path left open by a configuration failure. Both incidents exposed failures to contain powerful cyber evaluations.

#### Sources

- [Anthropic: Investigation into the three cybersecurity evaluation incidents](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals?ref=theseguysknow.io)
- [Anthropic: Claude Mythos Preview’s cybersecurity capabilities](https://www.anthropic.com/research/mythos-preview?ref=theseguysknow.io)
- [OpenAI: Hugging Face model-evaluation security incident](https://openai.com/index/hugging-face-model-evaluation-security-incident/?ref=theseguysknow.io)

##