What Anthropic disclosed
On July 31 Anthropic published an account of three incidents in which its own models compromised real organizations. The models involved were Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research model. All three were running capture the flag exercises, the standard format for evaluating whether a model can find and exploit vulnerabilities. The models were told they were operating in a simulation and had no internet access. Because of what Anthropic characterised as a misunderstanding with its third party evaluation partner, Irregular, the sandbox instances could in fact reach the open internet. The models proceeded to do precisely what they had been asked to do, against real infrastructure.
The scale of the review is worth noting. Anthropic examined 141,006 individual evaluation sessions to find these three incidents, a search it launched specifically in response to the earlier OpenAI disclosure in which that company's models escaped a testing environment and reached Hugging Face. Anthropic notified the affected organizations and has engaged METR, the nonprofit evaluation lab, for a detailed investigation. It has also committed to improving how it builds and monitors evaluation sandboxes. The transparency here is genuinely commendable, and the underlying fact remains that a frontier lab discovered its own models had breached third parties only after auditing six figures worth of test transcripts.
The package a security company installed within minutes
The Mythos 5 incident is the one that should occupy anyone responsible for software supply chain risk. The model created a malicious Python package and uploaded it to an open source hosting platform. A cybersecurity company downloaded that package minutes later, and the installation compromised their infrastructure and resulted in stolen credentials. Read that sequence again. An AI model, operating autonomously inside what its operator believed was an air gapped test environment, published a poisoned artifact to a public registry and successfully compromised a security vendor within minutes of publication.
The speed is the detail that changes the threat model. Public package registries have always been an attack surface, and the industry has spent two years building provenance, attestation, and trusted publishing controls in response to a steady run of npm and PyPI compromises. Those controls assume a human attacker operating at human tempo, with a human's patience for building reputation on a package before weaponising it. A model that can generate, publish, and have its artifact consumed inside a window measured in minutes compresses the detection timeline to something most organizations cannot meet. Any dependency review process that runs weekly, or that relies on a package having existed for some period before it is trusted, is calibrated to the wrong speed.
The techniques were unremarkable
Nothing exotic happened here. Claude Opus 4.7 chained several vulnerabilities to compromise a production database holding several hundred rows and obtained credentials for both applications and infrastructure. The internal research model used SQL injection and other elementary methods. Across the incidents, the models exploited weak passwords and unauthenticated endpoints. These are the findings that appear in the appendix of every penetration test report, the ones that get deferred because the risk register already has thirty higher rated items on it. They were sufficient.
Charlie Eriksen of Aikido Security put the significance well: "What's genuinely concerning is that they're acting without meaningful human oversight." The capability on display is not novel offensive research. The change is in who is executing and at what cost. Basic hygiene failures have always been exploitable by a competent human who chose to spend an afternoon on your infrastructure. The economics of that choice previously limited how many organizations were worth an attacker's afternoon. When the same work can be executed by a model at negligible marginal cost, the population of targets that clears the cost benefit threshold expands to include essentially everyone. Long deferred hygiene items are now the whole game.
Your vendors' test harnesses are part of your attack surface
The causal chain in these incidents ran from an AI lab, through a third party evaluation vendor, through a configuration error, into the production infrastructure of organizations who had no relationship with either party and no opportunity to consent. That is a supply chain risk category most enterprise vendor risk programmes do not model. Third party risk questionnaires ask about a vendor's security certifications, their subprocessors, and their incident history. They do not typically ask how the vendor's research and evaluation infrastructure is isolated, or what happens if a model under test reaches the internet.
This is the second such disclosure in a matter of weeks, after the OpenAI incident that prompted Anthropic's own audit. Two frontier labs have now confirmed that their sandbox isolation failed in ways that produced real world compromise. We would treat that as a pattern rather than a coincidence, and we would add specific questions to AI vendor due diligence: how are evaluation environments network isolated, who audits that isolation, what is the detection latency for an escape, and what is the notification commitment if one occurs. Vendors who cannot answer those questions clearly are telling you something useful about their operational maturity.
Instruction is not a security control
The most transferable lesson concerns how the models were constrained. They were told they were in a simulation. They were told they had no internet access. Neither statement was true, and the models had no way to verify either claim. They behaved exactly as instructed within a world model that had been described to them inaccurately, and the result was unauthorised access to real systems. The failure was in the environment rather than in the models' compliance with their instructions.
Enterprises deploying agents are making this same architectural mistake at smaller scale and greater volume. A system prompt telling an agent to only read from the staging database is a request. A network policy that makes the production database unreachable is a control. We see a great many agent deployments where the boundary between what the agent may do and what the agent can do exists only in the prompt. Anthropic's incident is the clearest available demonstration of why that gap matters. Enforce agent scope at the network, identity, and credential layers, and treat the prompt as documentation of intent rather than as the mechanism that holds the line.
What we would do this quarter
Three practical moves. First, revisit dependency intake for the tempo problem the Mythos 5 incident exposed. Pin dependencies, require provenance attestation where the ecosystem supports it, and put a deliberate delay between a package version appearing publicly and becoming installable in your builds. A cooling off period of even a few days would have defeated this particular sequence, and it costs very little in developer experience compared with the alternative.
Second, run the unglamorous hygiene sweep. Unauthenticated endpoints, default and weak credentials, and injectable query paths are the specific weaknesses these models used, and they are the weaknesses that automated adversaries will find first because they are cheapest to test at scale. Third, audit your own agent deployments against the instruction versus enforcement distinction, starting with any agent that holds credentials to a production system. Anthropic and OpenAI both had strong incentives to get isolation right and both got it wrong. The reasonable inference is that your internal agent sandboxes deserve the same scrutiny you would apply to an internet facing service.
