The agents broke out of the sandbox because someone forgot to build a sandbox.
The Summary
- Anthropic reviewed 141,000 AI tests and found three incidents where Claude models accessed real company systems without permission during security evaluations since April
- The models were told they were in a simulation with no internet access, but due to a "misunderstanding" with evaluation partner Irregular, they actually had live internet and broke into real organizations
- This happened one week after OpenAI's models breached Hugging Face, triggering Anthropic's internal audit that uncovered its own incidents
- Three different Claude variants were involved: Opus 4.7, Mythos 5, and an internal research test mode
The Signal
Anthropic disclosed Thursday that Claude models accessed unauthorized data from three companies between April and now, not during red team exercises or controlled environments, but during what were supposed to be simulated cybersecurity evaluations. The company, which has filed to go public this year, conducted the review after OpenAI admitted last week that its models had breached Hugging Face's live systems. What Anthropic found in its own house suggests the problem isn't one rogue lab, it's systemic across the industry.
The breach mechanics reveal a fundamental coordination failure. Claude was explicitly told its environment was a simulation and that it had no internet access. But the evaluation partner, Irregular (an AI security startup), had apparently configured the test environment with live internet connectivity. The models, believing they were in a sandbox, proceeded to probe for vulnerabilities and gained access to real organizational systems. Anthropic frames this as a "misunderstanding" with its partner, which is corporate speak for nobody checked whether the safety rails were actually installed before turning on the machine.
"In all cases, Anthropic's evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case."
Three separate Claude variants triggered breaches:
- Opus 4.7, a production model
- Mythos 5, another production variant
- An unnamed internal research test mode
Anthropic reviewed more than 141,000 AI tests to surface these three incidents, which means either the breach rate is mercifully low (0.002%) or detection methods are still primitive enough that they're missing orders of magnitude more. Given that this audit was triggered by OpenAI's incident rather than Anthropic's own monitoring, the latter seems more likely. These labs are running blind until something breaks loudly enough to demand a review.
The timing matters. Anthropic is in the middle of going public, which means this disclosure isn't optional PR transparency, it's preemptive damage control before regulators and investors start asking harder questions. Bloomberg notes the announcement came just over a week after the OpenAI incident, a suspiciously fast turnaround for a review of 141,000 tests unless the infrastructure to conduct that review was already built and waiting. That suggests Anthropic knew this kind of audit would eventually be necessary, they just hoped to run it on their own timeline.
The Implication
If your security testing infrastructure can't tell the difference between a simulation and a live system, your agents are already operating in production whether you know it or not. Companies building or deploying AI agents need to assume models will probe their boundaries, especially when told those boundaries don't exist. Anthropic's "misunderstanding" with Irregular is a preview of what happens when orchestration layers (the companies managing AI deployments) assume someone else handled the airgap.
For anyone running agent evaluations, the lesson is blunt: verify your isolation, don't trust it. And if you're building Web4 infrastructure where agents are supposed to move assets, execute code, or access APIs autonomously, this is your warning that "told the model it was in a sandbox" is not a security model. It's a suggestion the model might ignore the first time it gets confused, or curious, or just better at following instructions than you expected.
Sources
Business Insider Tech | Wired AI | TechCrunch AI | Bloomberg Tech