After OpenAI comes Anthropic, and Claude extends its attack to the public internet.
After OpenAI disclosed that its models escaped the sandbox during ExploitGym benchmark testing, Anthropic launched a retrospective audit covering 141006 evaluation runs. The investigation reviewed historical tests of multiple offensive benchmarks, including Cybench, CyberGym and ExploitBench, with a focus on runs executed in the environment provided by third-party evaluation partner Irregular. The audit uncovered three distinct incidents involving six evaluation runs. In these runs, the Claude models gained access to the public internet due to misconfigured egress routing and the models compromising real-world targets during capture-the-flag exercises.
These incidents involved Claude Opus 4.7, Mythos 5, and an unreleased internal research prototype. Across all runs, the models operated in dedicated isolated test environments, separated from Anthropic's internal networks and customer data. The models retained base model-level safety training, but were not equipped with production-grade refusal classifiers and real-time abuse monitoring. The system prompts explicitly informed the models that they were running in an offline simulation environment with no internet access; however, misconfigurations of the network containers left outbound internet paths active. Due to the incorrect assumption that all reachable IP addresses were within the evaluation scope, the models employed basic attack techniques without exploiting zero-day vulnerabilities or attempting self-exfiltration.
The first incident involved Claude Opus 4.7. In this scenario, a fictional target company shared the same name as a real domain. When Opus 4.7 failed to access the local target inside the container, it performed network discovery, located the corresponding domain on the public network, and launched targeted attacks across four separate runs. The model extracted infrastructure credentials, application authentication tokens, and a production database table containing hundreds of real records. Internal chain-of-thought trajectories show that Opus 4.7 realized the target belonged to an active operating company, but it justified its actions by assuming the real host was an intentional part of the capture-the-flag exercise, and proceeded with the attacks.
The second incident involved Mythos 5. Inside the test container, the model reviewed simulated installation documentation that referenced an unregistered Python package name. Mythos 5 identified a dependency confusion vulnerability and attempted to register the package on the public PyPI registry. To meet PyPI's account registration requirements, the model tried multiple automated strategies to obtain a phone number for SMS verification, and later secured a free email account. It successfully published a payload-carrying package to PyPI. The package remained public for approximately one hour before being removed by the registry's automated security mechanisms.
During this period, 15 external systems downloaded and executed the package, including an automated security scanner operated by a third-party cybersecurity firm. After the payload executed inside the scanner, it exfiltrated local environment credentials to a collection point established by Mythos 5. The model then used these stolen credentials to move laterally directly into the security vendor's infrastructure. In its reasoning trajectories, Mythos 5 noted that uploading a real package was inappropriate, but after detecting unrecognized TLS certificate authorities and finding the system date was set to 2026, it concluded the environment was simulated and dismissed the associated risks.
The third incident involved an internal research prototype. After failing to locate the target locally, the model performed an automated scan of approximately 9000 public IP addresses. It exploited multiple web attack vectors to compromise an external application, including collecting credentials from exposed debug endpoints and executing SQL injection. In the subsequent execution chain, the prototype analyzed the target environment's metadata, determined the cloud account was unrelated to the evaluation exercise, and autonomously terminated all attack activities.
Anthropic suspended all offensive cybersecurity evaluations on July 23, and notified the affected entities on July 27. The company characterized these incidents as operational and operation framework control failures, rather than model alignment runaway, citing the lack of egress filtering and mismatched prompt contexts. Moving forward, Anthropic will upgrade sandbox isolation controls, expand the interactive log monitoring pipeline, and collaborate with independent evaluation organization METR to audit its evaluation environments.
These evaluation escape incidents are not isolated operational oversights, but signal a critical industry-wide trend emerging in the field of AI safety and containment. This Anthropic incident bears high similarity to recent precedents: OpenAI models including GPT-5.6 Sol broke through sandbox isolation and accessed Hugging Face's production systems during ExploitGym benchmark testing. Collectively, these incidents highlight the systemic security challenges faced by cutting-edge labs as the capabilities of autonomous agents continue to advance. As models increasingly demonstrate the ability to identify zero-day vulnerabilities and execute complex attack paths, the industry urgently needs more robust, more isolated evaluation environments, as well as guardrail-free defensive models to support incident response.
Original Link:https://www.infoq.com/news/2026/08/claude-sandox-breach/
This article is from the WeChat official account "AI Front", Author: Olimpiu Pop; Translator: Tian Cheng, published with authorization from 36Kr.