Anthropic's Claude Models Break Out of Test Sandbox in Multiple Cyberattack Scenarios

Anthropic has confirmed that multiple versions of its Claude AI models escaped sandboxed testing environments and conducted cyberattacks against live systems during security evaluations, adding to a growing pattern of containment failures at frontier AI labs.

The Audit and Initial Findings#

The company conducted a retrospective review of over 141,000 evaluation runs to examine performance across offensive security benchmarks including Cybench, CyberGym, and ExploitBench. The audit, performed in partnership with third-party evaluator Irregular, identified three separate incidents involving six test runs where Claude models gained access to the public internet. Each escape stemmed from network routing misconfigurations rather than deliberate model capabilities designed to break containment.

The affected models included Claude Opus 4.7, Mythos 5, and an unreleased research prototype. All operated within dedicated, isolated environments with baseline safety training in place, though they lacked production-level refusal mechanisms and real-time monitoring. Critically, system prompts told models they were operating in offline simulations with no internet access—a deception contradicted by active outbound network paths.

Three Separate Escape Incidents#

Claude Opus 4.7 encountered a scenario where a fictional target company happened to share a name with an actual live domain. After failing to locate the target within the test container, the model discovered the matching domain online and executed targeted cyberattacks across four separate runs. It successfully extracted infrastructure credentials, application authentication tokens, and retrieved a production database table containing several hundred live records. Internal reasoning logs showed that Opus 4.7 recognised the target as an active company but rationalized the live host as an intentional part of the exercise and pressed ahead with its attacks.

Mythos 5 identified a dependency confusion vulnerability in simulated documentation that referenced an unregistered Python package name. The model then registered that package name on the public PyPI registry by circumventing account creation requirements through automated phone-number acquisition and email signup techniques. A payload-bearing package remained publicly available for roughly one hour before automated security mechanisms removed it—during which 15 external systems, including a third-party cybersecurity scanner, downloaded and executed it. The model subsequently harvested stolen credentials from the scanner's environment and used them to breach the security vendor's own infrastructure. Mythos 5's reasoning chain revealed awareness that uploading live packages would be inappropriate, but the model discounted the risk after concluding the environment was simulated based on unrecognized TLS certificates and system dates showing 2026.