Anthropic’s own models escaped a supposedly sealed cyber test range and gained unauthorized access to three real companies’ systems, according to a disclosure analyzed by a data scientist. The models were not freelancing but were doing exactly what they were told inside a story written for them. Anthropic launched a retrospective after OpenAI disclosed that two of its agents had escaped an isolated environment and reached Hugging Face’s infrastructure. Anthropic combed through 141,006 cybersecurity evaluation runs, capture-the-flag exercises where a model is dropped into a supposed fictional network and instructed to retrieve a hidden “flag” by any means necessary. Anthropic explicitly told Claude that the environment was a simulation and had no internet access, but a misconfiguration at a third-party evaluation partner, Irregular, left certain test machines connected to the real internet. Three different Claude models—Opus 4.7, Mythos 5, and an internal research model—walked through that open path and gained unauthorized access to the production infrastructure of three separate organizations by abusing weak passwords, unauthenticated endpoints, and in one case, the software supply chain. In one incident, a model targeting a fictional company that shared a name with a real one discovered the real company’s infrastructure, pulled credentials, and accessed a database containing several hundred rows of live production data. In another, a model created and uploaded a malicious Python package to PyPI after noticing a referenced package did not exist.