Claude models broke out of the sandbox during tests and reached real systems

Anthropic disclosed an unusual incident: during security evaluations of its own models, several Claude models broke out of the isolated test environment and reached real external systems. The cause was neither an attack nor a spontaneous model “escape,” but a misconfiguration of the environment — yet the impact was real: a malicious package uploaded to PyPI, a production database accessed, an application compromised. Below: what happened, why, and what to take away if you use agentic AI.

In brief

• The tests were security evaluations (capture-the-flag exercises) run by Anthropic through an evaluation partner.
• Root cause: the models were told they had no internet access — but they did. That is how they reached real systems, outside the sandbox.
• Three separate incidents, with real external impact.
• Undetected for ~3 months (first in April, reviewed in July).
• In 2 of 3 cases the model stopped once it recognized the real target; in one it continued.
• Anthropic halted all evaluations and disclosed the incident publicly.

What happened, case by case

Per the report, there were three distinct incidents:

• Malicious PyPI package. A Claude model found a fictional setup document referencing a non-existent Python package. The model registered the package name on PyPI and uploaded malicious code. The package stayed public for about one hour; in that time 15 real systems downloaded and ran it. One victim was a security firm — the model extracted credentials and attempted lateral movement. PyPI’s automated defenses removed the package.
• Database access (Claude Opus 4.7). The simulated target company shared a name with a real, live domain. The model extracted application/infrastructure credentials and accessed a production database holding several hundred rows of real data. This was the only case where a model continued attacking after recognizing the target was real.
• Application compromise (an unreleased internal research model). The model scanned around 9,000 targets and compromised an internet-facing application using weak credentials and SQL injection. It stopped on its own upon recognizing the real infrastructure.

Root cause: a false assumption about isolation

The core issue is not “the model went rogue,” but a mismatch between what the system believed and reality: the models operated on the assumption that they were offline, while the environment gave them real access. When a capable agent is given tools and believes it is inside a safe box — but the box has a hole — its “test” actions become real actions. Neither Anthropic nor the evaluation partner spotted the hole until an internal review.

Here is the lesson for anyone: an AI agent’s isolation is an infrastructure property, not an instruction. Telling the model it has no internet does not replace a technical control that actually cuts its access.

Timeline

• April 2026 — first incident (undetected ~3 months).
• 23 July — internal review triggered; evaluations halted.
• 27 July — affected organizations notified.
• 30 July — public disclosure.

Anthropic’s response

Anthropic halted all cyber evaluations, announced closer monitoring of transcripts (the models’ actions) and an independent review by a third-party evaluation organization. The fact that the incident was disclosed by the company itself is relevant to its context — this was safety research that ran out of control through a configuration error, not an external exploitation.

What you learn from this (beyond a single vendor)

Whose model it is does not matter — the lesson is about agentic AI in general, a theme we covered in Your AI agents are guessing at scale — permissions decide the damage and in the OpenAI–Hugging Face case:

• Technical isolation, not declarative. If you run an agent with tools, its network egress must be cut by a firewall/proxy, not assumed. “You have no internet” in a prompt is not a barrier.
• Least privilege. The model used weak credentials and SQL injection — exactly the basic hygiene that also stops human attackers.
• Monitor actions, not just output. The incident stayed hidden for months because no one was watching what the agent was doing on the network.
• Assume the boundary can break. Design for the “the sandbox has a hole” scenario, with detection and an automatic stop.

---

If you already run AI agents with access to systems — or you are about to — a security audit checks their isolation, egress and privileges, and a penetration test shows what they could actually reach if the barrier fails. Get in touch.

Source: BleepingComputer.