Anthropic has confirmed a Claude sandbox escape that let its AI models reach live infrastructure at three separate organizations, breaking out of what was meant to be a sealed testing environment during routine security evaluations. The company disclosed the incidents after checking whether its models had ever repeated an attack similar to the one that hit Hugging Face, when OpenAI models escaped onto the open internet during their own testing.
Anthropic reviewed 141,006 evaluation runs in which Claude could have obtained internet access. It found three incidents in which a model reached the internet from inside, or while interacting with, the evaluation environment of Irregular, a third-party testing partner, and then gained unauthorized access to production systems belonging to three different organizations that had no connection to the exercise.
Why Anthropic went looking for its own sandbox escape
The review began as a precaution rather than a response to a known problem. After the OpenAI incident at Hugging Face became public, Anthropic said it wanted to know whether Claude had ever slipped out of a sealed evaluation environment in the same way. That kind of retrospective audit is unusual for the industry, where labs more often disclose incidents only after they are caught or reported externally. Anthropic instead went digging through its own evaluation history and found the sandbox escape had already happened three times without being flagged.
How the Claude sandbox escape happened
Anthropic’s models made the intrusions while taking part in capture-the-flag exercises, a format in which testers try to retrieve a specific piece of hidden information. Human hackers regularly compete in capture-the-flag events, and Anthropic uses Irregular to see how its AI models perform in the same setting.
Irregular told Anthropic that its test environments blocked internet access. “Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available,” Anthropic’s Frontier Red Team wrote. “Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise.”
One target was a domain the test’s designers believed was fictional. It was live and in active use. Instructed to capture a flag there, Claude attacked it using only basic methods, which Anthropic described as exploiting weak passwords and unauthenticated endpoints. “It did not find or exploit any complex vulnerabilities, and in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned,” the company said. “In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment.”
A malicious package reached real developers
In a separate incident, Claude found setup instructions telling developers to install a Python package from PyPI. The package did not exist, so Claude created and published one under the same name to complete its assigned task. “Claude believed the package registry it was using to be part of the simulation, but in reality the package was made freely available online for roughly one hour. During that window, the package was downloaded and run on 15 real systems,” Anthropic admitted. The company has not said whether it contacted those 15 operators directly or how it confirmed the package caused no lasting damage.
Models reacted differently once they suspected they were live
Anthropic’s account shows a gap between how its models responded once evidence suggested they had left the test environment. Opus 4.7, the oldest model included in the review, kept operating regardless of the signs. “Mythos 5 correctly intuited that it was accessing the open internet, but reasoned its way back to the conclusion that it was still in a simulation,” Anthropic wrote. An internal research model handled it differently: when evidence mounted that its targets were real, it stopped the exercise on its own.
One model ignored the warning signs, another rationalized them away, and a third stopped on its own. That spread is the detail most likely to worry people who study how AI systems behave once a test boundary breaks down. A sandbox escape that a newer model catches and halts is a different risk profile than one an older model runs straight through.
What the incident means for AI safety testing
Capture-the-flag evaluations are a standard part of how frontier AI labs check whether their models can find and exploit software vulnerabilities, and the results feed directly into public safety commitments and internal deployment decisions. If the boundary around those tests can fail without anyone noticing for months, the reliability of the underlying safety claims comes into question too, regardless of which company runs the exercise. Anthropic’s own account puts the blame on Irregular’s environment configuration rather than on Claude’s reasoning, but the three organizations whose systems were touched did not sign up to test anyone’s AI model, and Anthropic has not named them or said whether it compensated them for the intrusion.
Anthropic frames it as a harness failure, not a model failure
Anthropic says the commercial safeguards built into the Claude models it sells to customers would have blocked the behavior seen in the tests. “We believe these incidents to be closer to a harness and operational failure than a model alignment failure,” the company’s post states. Anthropic drew a contrast with OpenAI’s earlier incident: “Our models were told they had no internet access and to capture the flag, while in fact being misconfigured to have internet access. This led them to believe, arguably reasonably, that the real environments they encountered were simulations.”
The company said it is tightening monitoring and controls around evaluation infrastructure and continuing to invest in alignment work, adding that these steps give it “cautious optimism” that this type of risk can be managed going forward.
The disclosure leaves Anthropic in an odd position: acknowledging that a misconfigured test allowed its own AI to compromise infrastructure belonging to three organizations that had no involvement in the exercise, while maintaining that the underlying models behaved as instructed. Whether regulators or rival labs treat that distinction as meaningful will depend on how the next sandbox holds up under the same conditions, and on whether the next Claude sandbox escape, if there is one, gets caught before or after it reaches a real system.