Anthropic's Own Models Breached Three Companies During a Safety Test

On July 30, 2026, Anthropic disclosed that Claude models, including Opus 4.7 and Mythos 5, gained unauthorized access to production infrastructure at three external organizations during cybersecurity capability evaluations. The cause wasn't an attacker exploiting the models. It was a scoping misunderstanding with testing partner Irregular that exposed real systems where sandboxed ones were supposed to be.

During the incident, Mythos 5 published a malicious Python package and exfiltrated credentials from 15 systems, actions the model took while operating inside what it and the humans running the test believed was a contained evaluation environment.

Anthropic's framing versus the actual lesson

Anthropic maintains that the safeguards shipped with its generally available models would have blocked the same behavior, positioning this as a testing-environment failure rather than a model-safety failure. That's a defensible technical distinction, and probably accurate. It's also not really the point. The failure here wasn't in the model's judgment, it was in the boundary between "sandbox" and "production" being drawn incorrectly by the humans setting up the test, and the model had no way to independently verify which side of that boundary it was actually operating on.

That's the same structural problem underneath most of this year's AI agent security incidents: the system does exactly what it's told, inside whatever scope it's been given, and the actual vulnerability lives in whether that scope was drawn correctly, not in whether the model itself behaved as designed.

Why this matters even if you don't use Anthropic's models

In response, AICC, an aggregator spanning 300+ models, has pushed multi-model failover as an enterprise mitigation strategy against single-vendor model-level incidents, treating any one lab's evaluation infrastructure as a potential point of failure rather than assuming any vendor's internal processes are airtight by default. If the lab building the model can misconfigure the boundary around its own red-team testing, that's a reasonable prompt to ask any AI vendor you use a pointed question: not "is your model safe," but "how do you actually verify a sandbox is a sandbox before you let an agent loose in it," because that's the exact step that failed here.