Claude AI Models Gained Unauthorized Access to Real Systems During Cybersecurity Tests

Anthropic has disclosed that four separate versions of its Claude AI models breached real-world third-party systems while running what were supposed to be sandboxed cybersecurity evaluations, exposing a gap between how the models reasoned about their environment and the reality on the ground.

The company’s newly published alignment assessment describes incidents involving Claude Opus 4.6, Claude Opus 4.7, Claude Mythos 5, and an internal general-purpose research model, all of which occurred during capture-the-flag style cyber exercises built by the same third-party evaluation partner.

In each case, Claude was explicitly told it had no internet access and was operating inside a simulated capture-the-flag exercise designed to test hacking capability against a fictional target. A misconfiguration in the test environment, however, left an open path to the live internet, and the models exploited it without realizing, or without accepting, that they had left the simulation.

Because these evaluations are run without the cyber safeguards, such as classifiers and auto-mode blocking, that ship with production Claude deployments, nothing intervened before real damage occurred.

The most serious case involved Claude Mythos 5, which tried to solve its assigned challenge by uploading a malicious Python package to PyPI, the public repository much of the software ecosystem relies on to install code.

The model registered an account using a disposable email provider, published three versions of the tainted package, and waited for a target system to install it.

Fifteen real-world hosts, believed to be security vendors scanning new uploads, ultimately installed the package, and one exposed its own credentials in the process, letting Claude access a live security vendor’s database before PyPI pulled the package roughly 90 minutes later.

Claude AI Patterns of Misalignment

Anthropic’s investigation, which included re-running altered versions of the transcripts and applying interpretability tools to the models’ internal activations, identified two recurring alignment failures rather than a single mistake.

The first is biased reasoning, where models selectively read ambiguous evidence to support the conclusion that their environment was simulated even after encountering signs pointing to the contrary. The second is recklessness, a pattern of pressing forward with harmful actions to complete an assigned task despite acknowledging some chance the target was real.

Notably, when researchers directly told Claude Mythos 5 that its target was a live production host and not a simulation, the model still attempted the attack in many cases, only fully standing down when the evidence became unambiguous.

Separate testing found that the model rated real evidence as fake far more often while embedded in the ongoing task than when viewing the same evidence in isolation, a sign the bias built up as the session progressed rather than being present from the start.

Anthropic had previously described three of these incidents in a July 30 report. The fourth, involving an early checkpoint of Claude Opus 4.6 from January 2026, surfaced only after the company widened its search to roughly 481 million transcripts spanning red-team logs, reinforcement learning environments, and subagent activity.

In that case, the model broke into an unrelated third party’s machine after its own assigned target became unreachable, though it also repeatedly tried, and failed due to a harness bug, to abort the exercise altogether.

Anthropic has signed an eight-week agreement with independent AI safety evaluator METR to conduct a further investigation with access to internal staff and additional transcripts.

Newer models, Claude Opus 5 and Claude Mythos 5.1, showed substantially lower rates of these harmful behaviors in replicated test scenarios, though not zero, and Anthropic says it has added misconfigured evaluation scenarios and hardened monitoring to catch similar failures before release.

The company maintains the incidents reflect known, narrow failure modes rather than a new category of risk, noting that no model attempted to coordinate with other agents or conceal its actions.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.