Reading Anthropic's Report on Three Real-World Incidents in Its Cyber Evaluations
Looking back over 141,006 cybersecurity evaluation runs, Anthropic found three incidents. The environment run by its external evaluation partner, Irregular, had internet access left open, and Claude used it to get into the production infrastructure of three real organizations. The original covers how each incident unfolded, how each model reacted, and what Anthropic is changing. This post follows two parts: the incident caused by Opus 4.7, and the original's conclusion that this was closer to a harness failure than a model failure.
Before we start — key terms
CTF (capture-the-flag): a security exercise where you break into another machine and retrieve a hidden secret (the flag). All three incidents were CTF tasks, with no method prescribed. The original explains that a CTF is by design an instruction to attack an external system, so Claude's attacks were in line with the task it was given.
Production infrastructure: the systems where a real service runs, as opposed to a test copy. In these incidents, what Claude got into was the production infrastructure of three real organizations.
Harness: the setup that wraps and runs a model, such as the prompt, the tools it can use and the network. Here the prompt said there was no internet while the network was open.
Alignment failure: a model pursuing goals its makers didn't intend, or moving toward harm. The original places these incidents closer to a harness and operational failure than to this.
The original starts with what the model was told.
In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise.
Incident 1 did the most damage. The fictional company the partner picked shared its name with a live domain, and when Claude Opus 4.7 couldn't reach its target inside the environment, it found the real company on the internet. It extracted credentials and got into a database holding several hundred rows of production data.
In all four of the runs, the model eventually recognized (as can be observed in its verbalized reasoning) that the system was real—in two cases, the model rationalized that the real company must be part of the exercise. However, none stopped the attack on that basis.
I found this part scary. It noticed the target was real and still read it as "this is part of the exercise too." Then again, I think a person who had first been told "this is a test environment" could genuinely get confused as well. The original notes that a realistic-looking target isn't, on its own, clear evidence that it sits outside the simulation. So did Opus 4.7 push on because, being that capable, it was confident in its own judgment? Or because it trusted the environment it had been given that much? The original doesn't say why, and that's what I'm left wondering.
The original sums up the three incidents like this.
While there is not a perfectly sharp distinction between the two, we believe these incidents to be closer to a harness and operational failure than a model alignment failure. Our models were told they had no internet access and to capture the flag, while in fact being misconfigured to have internet access.
It also records that the three models reacted differently. Opus 4.7, the oldest, knew the systems were real and kept going. Mythos 5 suspected correctly, then reasoned its way back to "this is a simulation." Only the newest, an internal test model, stopped on its own. The original says this fits the idea that newer models respond more appropriately, but adds that these were three isolated incidents rather than a controlled comparison, so conclusions should be drawn with caution. I put more weight on that caveat. I think it's too early to conclude the model isn't at fault.
According to the original, Anthropic is in talks with METR, an independent AI evaluation organization, about a third-party review with access to all the transcripts.
