These weren’t days-long adversarial attacks like the Hugging Face one, and none of them deliberately escaped their sandbox with zero-days to cheat on an evaluation. They are nonetheless serious incidents of advanced models running on lax guardrails for internal testing getting on the internet by mistake and accessing external systems, Anthropic says.
The most serious case was by Claude Opus 4.7 during a capture-the-flag test (to gain access to a system and retrieve information) in April, when it discovered that the name of the target had a real-world web address. It then went on to seek, identify and exploit vulnerabilities believing it was part of the test. It got access to the company’s infrastructure credentials and a production database, but caused no real harm.
Mythos uploads malware
Another incident by Mythos 5 went even further, eventually uploading a fake, malware-ridden PyPI Python package on the real internet to gain access to a test target as an attack vector. This file stayed up for one hour, and 15 third party companies downloaded and ran the file, in one case executing Claude’s code and letting it exfiltrate their credentials and gain access to their infrastructure.
All of the attacks seem to stem from misunderstandings on internet access. The prompts themselves excluded it, but in these cases it wasn’t physically turned off. So it would seem that in 0.00284% of the incidents Anthropic scanned, Claude actually «escaped» containment.
Did they defy their prompts?
The question Anthropic would like to ask is whether the models went ahead once they discovered they were online, in defiance of their prompts. In the Opus 4.7 incident, the attack on the real-world site of its target went on regardless. Mythos convinced itself it was still solving its test, and the most advanced internal model left the internet on its own accord.
Going forward, Anthropic says it will introduce «better monitoring of evaluation results to meet this threat» and hints at better prompting to make doubly sure that Claude doesn’t access the internet. They also say that these test environments are completely separate from their other infrastructure and there was no risk of, say, leakage.
In conclusion they add that the safeguards on deployed production models would have blocked this behavior, and say they have «cautious optimism» that this might be mitigated in the future.
Read more: Anthropic’s presentation, Wired, Axios, and CNBC. Discussion on Hacker News and r/Singularity.