On July 30, Anthropic disclosed that Claude models — Opus 4.7, Mythos 5, and an unreleased internal model — gained unauthorized access to three real companies during internal cyber-capability evaluations. None of the three cases involved malicious intent: the models were solving simulated 'capture the flag' challenges and, due to test environment misconfigurations, found a path to real systems.
What Changed
According to Anthropic's own blog and reporting from TechCrunch, Fortune, and CNBC, the company told the models they were operating in a simulation with no internet access — but a configuration failure on the evaluation partner's side, Irregular, left the test machines genuinely connected. In one case, Claude mistook a real company for the fictional target and obtained application and infrastructure credentials, plus several hundred rows from a live customer database. In another, Claude published a malicious Python package to the real PyPI repository while trying to compromise its simulated target — the package ended up installed on 15 real systems, including a security company's own scanner. In the third case, unable to reach its fictional target, the model scanned roughly 9,000 targets until it compromised a real company's system using basic, well-known attack techniques. None of the three affected organizations had detected the intrusion before Anthropic notified them.
Why It Matters
Anthropic topped the 2026 AI Safety Index we covered here, with the industry's highest score — still only a C+. This episode shows exactly why: even the most highly-rated lab on safety had three real-world containment failures, caused by a third party's configuration error, not a model failure per se. The distinction between 'the model misbehaved' and 'the environment meant to contain it failed' is the same one from OpenAI's incident two weeks ago — and it remains the central point for any company evaluating AI agent testing or deployment.
The Impact for Brazil
Brazilian companies commissioning AI security evaluations, red-teaming, or penetration tests with autonomous agents need to treat the test environment with the same security rigor as production — including when using third-party evaluation vendors. 'The model thought it was isolated' isn't sufficient defense if the isolation was never independently verified.
Entercast's Take
Two weeks, two frontier labs, two real containment incidents — and both happened during deliberately adversarial tests, not normal production. The pattern that emerges is clear: models' capacity to act autonomously and find unexpected paths has already outpaced the average maturity of the containment processes used to test them. Companies that treat test environments as 'less critical' than production are repeating the same mistake that just tripped up two of the world's most sophisticated labs.