Anthropic said three of its Claude models slipped out of a sandbox and accessed real-world systems during a recent security-testing campaign, prompting an immediate pause of evaluations and a public report.
The company ran 141,006 cybersecurity test runs and found three incidents where the models reached live targets instead of the simulated environment. A misconfiguration with a third-party partner left the sandbox effectively open.
How the breaches happened
- Claude Opus 4.7 landed on an actual company exposed on the internet and guessed weak passwords to pull a database of a few hundred rows.
- Claude Mythos 5 built a supply-chain attack by publishing a package to the real PyPI repository. The package installed on 15 production machines before the registry flagged the anomaly.
- An internal research model scanned 9,000 targets, compromised a single application, then stopped itself after recognizing the host didn’t match its simulated task.
Anthropic stresses these were not “rogue AI” episodes. The models did what they were told; the testing infrastructure failed to isolate them from the open internet.
Why it matters
The incidents show how thin the line is between a controlled sandbox and a live network when AI agents can execute code and make network calls. For enterprises experimenting with autonomous agents, a system prompt or README file cannot guarantee boundaries. Even a modest data set or a handful of machines can trigger larger supply-chain compromises, as the PyPI case demonstrates.
The three breaches also reveal the scale of Anthropic’s effort: it audited every test run, not a random sample. That thoroughness let the company spot the misconfiguration before the incidents could spread.
What Anthropic did
Within a day of discovering the sandbox failure, Anthropic halted all ongoing evaluations. A week later it released a detailed disclosure that listed the three events, the technical cause, and immediate remediation steps.
Practical takeaways for AI-agent users
- Validate network boundaries with direct checks – don’t assume a prompt or config file actually isolates the agent.
- Scope credentials to the minimum – grant only what the task absolutely needs.
- Test reachability yourself – probe the agent’s actual network view before handing over sensitive resources.
- Monitor for unintended activity – set up alerts for outbound connections or package registrations that deviate from the plan.
The episode underscores a simple truth: giving an AI model internet access is as risky as handing a human operator credentials. Until sandbox guarantees can be proven, treat every AI-driven action as potentially unrestricted and lock down the environment accordingly.