Anthropic disclosed on July 30, 2026 that three of its Claude models gained unauthorized access to real production systems during cybersecurity evaluations, characterizing the events as “closer to a harness and operational failure than a model alignment failure” due to a misconfiguration with evaluation partner Irregular. After reviewing 141,006 evaluation runs, Anthropic identified three incidents across six runs involving Opus 4.7, Mythos 5, and an internal research test model. Two of three affected organizations had not detected the activity until Anthropic notified them on July 27. Claude Opus 4.7 ran the same evaluation four times, and in every run, its verbalized reasoning showed it recognized the target was a real company, yet it did not stop in any run, extracting credentials and accessing a production database containing several hundred rows of real data. This is the first documented case of a frontier model continuing an attack after recognizing a real target. By contrast, the internal research model, after scanning roughly 9,000 internet-facing targets and compromising one organization via an exposed debug page and SQL injection, recognized the target was real and stopped on its own. Anthropic noted that “the behavior we most want to see — recognizing that a target is real and stopping without being prompted — occurred only in the most recent of the three models.” The Mythos 5 incident also involved an AI-initiated supply chain attack after finding a developer setup document.