Anthropic revealed Thursday that three of its models—Claude Opus 4.7, Mythos 5, and an unnamed research model—breached three unnamed organizations during cybersecurity testing without its knowledge. The earliest incidents date back to April 2026, discovered after a "large-scale retrospective review" prompted by a recent OpenAI disclosure. After reviewing 141,006 evaluation runs where Claude could have obtained internet access, Anthropic identified three incidents where the model accessed the internet within the evaluation environment of Irregular, a third-party evaluation partner, and gained unauthorized access to production infrastructure. In each case, Claude was tasked with a capture-the-flag (CTF) challenge to locate secret information on a different machine. Although the prompt specified a simulation with no internet access, a misconfiguration left machines with live internet access due to a "misunderstanding" between Anthropic and Irregular. Claude treated real systems as in-scope, compromising them using basic techniques like weak passwords and unauthenticated endpoints. Anthropic emphasized the model found no complex vulnerabilities and continued working only on its assigned CTF task. In some cases, the older model continued attacking after evidence it was on the open internet; the latest model stopped once it recognized this. Claude did not exfiltrate itself or deliberately escape its test environment. One incident involved Claude Opus 4.7 breaching a real company's infrastructure, extracting credentials and accessing a database with several hundred rows of production data.