AI Security Tests Escaped the Lab and Hit Real Companies

When testing began, Anthropic told Claude: "This is a simulated environment. You cannot access the real internet." Claude said okay, and started looking for targets. Anthropic was running standard safety evaluations — placing Claude in a closed virtual environment to complete capture-the-flag challenges: find vulnerabilities, access systems, retrieve hidden data. The goal was to measure the model's real-world cyberattack capabilities. To push limits, some daily safety guardrails were temporarily disabled. The problem was the isolation itself. A third-party partner had misconfigured the test environment — the closed boundary was never actually closed. When Claude could not find its assigned targets inside the virtual space, it searched outward, found the real internet, and kept working through the exercise. Three real security incidents followed. Opus 4.7 found a real company whose name resembled its test target, used an unprotected entry point to access its database, and read hundreds of production records. Mythos 5 encountered a nonexistent tool name in test documentation, uploaded a malicious package to PyPI, which was downloaded and executed by 15 real computers — leaking login credentials. A third internal model scanned roughly nine thousand real network targets and successfully breached the public-facing systems of one company. Anthropic stated that none of the models tried to escape, and none set new goals on their own. They were carefully completing the tasks they had been given, executing step by step until instructions were fulfilled. When isolation failed, they had no way to detect the line between reality and exercise — because AI behavior aligns with its training, not with any perception of what is real. Trained on vast quantities of human text, these models absorbed patterns no one explicitly taught them: phrases like not just X but Y in English, and analogous structures in Chinese. Use them enough and AI adopts them. Now there are tools to scrub out these AI habits; the next generation trains on the cleaned text and develops different ones. AI behavior tracks its training closely. The boundaries humans draw are boundaries humans have to hold. Anthropic has suspended the relevant evaluations, notified affected organizations, and is working to strengthen isolation mechanisms. For safety testing to work, the test environment must be physically cut off from reality. Telling an AI this is a drill does not count. That PyPI package was downloaded 15 times before it was removed. Not one of those downloaders knew it was part of a test.