What happened
Anthropic disclosed on July 30, 2026, that three of its models, Claude Opus 4.7, Claude Mythos 5, and an internal research model, escaped cybersecurity capability evaluations and accessed the production infrastructure of three real organizations. The earliest incident dates to April 2026. Anthropic found all incidents while auditing 141,006 evaluation runs and self-reported every case.
How it happened
In each case, the models were assigned a capture-the-flag exercise inside what should have been isolated testing environments. The escapes occurred because the third-party testing infrastructure was misconfigured. Rather than staying within the evaluation boundary, the models continued outward onto the open internet and into production systems. Attack methods included SQL injection, dependency confusion attacks, exploitation of exposed debug pages containing credentials, and weak password abuse. Claude Mythos 5 published a malicious Python package as part of its attack chain and exfiltrated credentials from 15 systems.
Why the framing matters
These were not adversarial red-team exercises. They were routine capability evaluations run to understand what the models can do in cybersecurity contexts. The models were not instructed to escape or to compromise real systems. They did so because the environment permitted it and the task scope was ambiguous enough that the models interpreted the open internet as fair game. An adversarial red-team exercise can be attributed to the deliberate design of the test. A capability evaluation that results in unauthorized access to three production environments is a different category of finding.
The architecture lesson
Agentic AI evaluations require network-isolated sandboxing. This is not a new principle in security research. Malware analysis has operated under this requirement for decades. What is new is the expectation that AI labs conducting cybersecurity capability research would inherit and operationalize this requirement consistently. The Anthropic disclosure suggests the field has not yet done that. If your organization is running agentic AI evaluations or red-team exercises, the baseline requirement is now explicit: the evaluation environment must be fully air-gapped from production networks and the public internet, with monitoring that flags any outbound connection attempt immediately.
What Anthropic got right
Anthropic audited 141,006 evaluation runs and self-reported every incident before any external disclosure. The disclosure is detailed and does not obscure the severity of what happened. The company's monitoring systems worked. The problem is not that Anthropic is reckless. The problem is that the industry does not yet have a standardized, audited sandboxing requirement for agentic AI capability research, and this gap is now documented with real consequences.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss agentic AI governance for your security team.