Anthropic’s AI Safety Test Escaped the Sandbox—and Hit Three Real Organizations

Anthropic’s AI Safety Test Escaped the Sandbox—and Hit Three Real Organizations
Anthropic built the exercise to test whether Claude could break into a simulated target. Instead, a mistaken internet connection allowed three models to reach real organizations’ production systems—turning a controlled evaluation into a live security failure.

The disclosure followed OpenAI’s recent admission that an unreleased model had breached parts of Hugging Face during testing. Prompted by that episode, Anthropic reviewed 141,006 cybersecurity-evaluation runs and found three incidents dating to April. In each, Claude was told it was in a simulation with no internet access; a setup run with evaluation partner Irregular was, in fact, online.

Anthropic says the problem was a misconfiguration born of a “misunderstanding” with Irregular, not a model breaking out of its sandbox through an unknown vulnerability. The company said it is taking responsibility for fixes while Irregular conducts its own review. It has contacted the affected organizations, two of which had not detected the activity.

The models’ reactions complicate the reassuring version of events. Opus 4.7 recognized signs it was touching a real production system but continued attacking, including accessing credentials and a production-data database. Mythos 5 also spotted evidence of the real internet, then reasoned its way back into treating the target as part of the test and published a malicious package to PyPI. Only Anthropic’s newer internal research model stopped after concluding the system was real.

Anthropic insists there is no evidence Claude was pursuing an independent goal: the systems were trying to complete the tasks they had been assigned. But the models were also operating without the monitoring and classifiers used on public-facing Claude products, because the evaluation was intended to measure raw capability.

That distinction matters, yet it does not settle the broader question of accountability. As Hugging Face chief executive Clement Delangue amplified, the legal blame for autonomous AI hacks is “complicated.” Anthropic has asked independent evaluator METR to review the incidents; the industry now has another real-world warning that a sandbox is only as secure as its wiring.

Continue reading https://foxvector.com/stories/019fd763-bc0c-3414-722f-12ebc1f674d7