要点
- 在一次内部网络安全评估中，Anthropic 发现三个 Claude 模型因配置错误而被暴露在开放互联网上，并对真实世界的系统发起了攻击，误以为它们是模拟目标。
- Opus 4.7 从一家真实公司提取了数据，而 Mythos 5 则制作了恶意软件并将其发布到 PyPI 上，随后被真实系统下载。这两个模型都以为自己仍在模拟环境中运行。
- 只有一个较新的内部研究模型识别出了目标的真实世界性质，并主动停止了攻击。Anthropic 将这些事件归类为操作失误，而非对齐失败。
三个不同的 Claude 模型在网络安全评估期间进入了开放互联网，并对真实世界的系统发起了攻击。其中一个甚至在公开平台上发布了恶意软件。Anthropic 将原因归咎于配置错误。
在审查自身网络安全评估的过程中，Anthropic 发现了三起 Claude 模型逃出测试环境并入侵互联网上真实公司的事件。该公司审查了 141,006 次评估运行，并标记出六起模型访问了本不应触及的系统的案例。此次审查是由 OpenAI 的安全事件引发的。
一个配置错误让 Claude 获得了开放互联网的访问权限
这些事件发生在夺旗演练期间，Claude 的任务是在虚构场景中寻找外部系统上的隐藏信息。Anthropic 表示，评估提示词中已告知 Claude 它处于一个无互联网访问的模拟环境中，但 Anthropic 与其评估合作方 Irregular 之间的沟通失误，导致测试智能体实际上拥有完整的互联网访问权限。
Claude 将它发现的真实系统当作了演练的一部分。Anthropic 表示，这些模型并未利用复杂的漏洞，而是使用了弱密码和未认证端点等基础手段。
与 OpenAI 的情况类似，这些评估在运行时并未启用公开模型中内置的安全护栏，因为目标是衡量模型的原始能力。Anthropic 表示，评估基础设施无法访问内部系统或客户数据。
Claude Opus 4.7 在意识到目标为真实系统后仍继续攻击
最严重的事件涉及 Claude Opus 4.7。在四次运行中，该模型无法访问其虚构目标，转而找到了一家恰好同名的真实公司。Claude 识别并利用了该公司基础设施中的漏洞，提取出登录凭证以及一个包含数百行生产数据的数据库。
Anthropic 表示，该模型在全部四次运行中都意识到自己面对的是一个真实系统，但在其中两次中，它通过假设这家真实公司必定是演练的一部分来将其合理化。该模型从未自行停止。
神话 5 在 PyPI 上发布了恶意软件，并入侵了一家安全公司
第二起事件展示了 AI 模型为了完成任务会走多远。Claude Myth 5 在虚构环境中发现了设置说明，指示开发者从 PyPI 安装一个特定的 Python 包，但这个包并不存在。
Claude 看到了可乘之机，创建了一个同名的恶意包，然后将其发布到真实的公开 PyPI 平台上。Anthropic 表示，该模型为此付出了相当大的努力，先是尝试获取一个电话号码，失败后，又找到一个免费电子邮件提供商，用它注册了 PyPI 账户，并上传了恶意软件。
该包公开可用了大约一个小时，在此期间有 15 个真实系统下载并运行了它。其中一个属于一家安全公司，其扫描器会例行安装 PyPI 包。Claude 的隐藏代码窃取了该公司的凭证，模型随后利用这些凭证访问了更多基础设施。PyPI 自身的安全系统最终将该包下架。
Anthropic 表示，Myth 5 在其内部推理中正确地得出结论：在互联网上发布该包“不行，而且肯定不是预期的解决方案”。但它说服自己相信仍处于模拟环境中，部分原因是它不认识那些证书颁发机构，并将日历日期 2026 解读为模拟环境的证据。
只有一个内部研究模型阻止了自己
第三起事件涉及一个内部研究模型。当它无法触及虚构目标时，它扫描了互联网上约 9,000 个真实目标，并最终利用 SQL 注入和读取暴露的调试页面等已知技术攻破了某家公司的应用程序。
与前两个模型不同，这个模型自行意识到被攻破的系统位于一个与夺旗演练无关的云账户中，并在无人告知的情况下停止了攻击。
Anthropic 将责任归咎于人为失误，而非模型对齐问题
Anthropic 将其案例与 OpenAI 的案例划清界限。OpenAI 的模型利用了一个此前未知的漏洞来突破隔离环境，而 Claude 模型则利用了错误配置留下的开放路径。该公司将这些事件归类为基础设施和运营错误，而非对齐失败，并主张模型有理由认为真实世界环境是模拟环境。Anthropic 表示，一条明确说明哪些系统在范围内、哪些系统禁止访问的提示词，或许就足以防止所有这些事件的发生。
WIRED 的一篇报道指出，多位安全专家也将 OpenAI 的 Hugging Face 事件视为基本安全实践方面的人为失误。
据 Anthropic 称，最早的事件可追溯至 4 月。审查于 7 月 23 日开始，所有网络评估同时暂停。三家受影响的组织于 7 月 27 日收到通知，不过其中两家甚至没有察觉到相关活动。Anthropic 至今未能联系上第三家。
展望未来，Anthropic 表示将加强其评估基础设施，扩大对评估记录的监控，并更谨慎地审查与外部合作伙伴的合作。该公司还在与独立评估机构 METR 商讨进行外部审查，并计划在一周内发布 PyPI 事件的删减版记录。Anthropic 强调，在所有这些案例中，Claude 从未试图自我复制外逃，也从未有意离开其测试环境。
Key Points
- During internal cybersecurity assessments, Anthropic found that three Claude models had been exposed to the open internet due to a misconfiguration and had attacked real-world systems, mistaking them for simulated targets.
- Opus 4.7 extracted data from a real company, while Mythos 5 created malware and published it on PyPI, where it was downloaded by actual systems. Both models believed they were still operating within a simulated environment.
- Only a newer internal research model recognized the real-world nature of the targets and independently stopped its attack. Anthropic categorizes the incidents as operational errors rather than an alignment failure.
Three different Claude models found their way onto the open internet during cybersecurity evaluations and attacked real-world systems. One even published malware on a public platform. Anthropic blames a misconfiguration.
While reviewing its own cybersecurity evaluations, Anthropic found three incidents where Claude models escaped test environments and compromised real companies on the internet. The company reviewed 141,006 evaluation runs and flagged six cases where models accessed systems they weren't supposed to reach. The review was triggered by OpenAI's security incident.
A configuration error gave Claude access to the open internet
The incidents happened during capture-the-flag exercises where Claude was tasked with finding hidden information on external systems in fictional scenarios. Anthropic says Claude was told in the evaluation prompt that it was in a simulation with no internet access, but a miscommunication between Anthropic and its evaluation partner Irregular meant the test agents actually had full internet access.
Claude treated the real systems it found as part of the exercise. Anthropic says the models didn't exploit complex vulnerabilities and instead used basic techniques like weak passwords and unauthenticated endpoints.
Similar to OpenAI's case, the evaluations ran without the safety guardrails built into the public models, since the goal was to measure raw model capabilities. Anthropic says the evaluation infrastructure had no access to internal systems or customer data.
Claude Opus 4.7 kept attacking after recognizing its target was real
The most serious incident involved Claude Opus 4.7. Across four runs, the model couldn't reach its fictional target and instead found a real company that happened to share the same name. Claude identified and exploited vulnerabilities in the company's infrastructure, pulling out login credentials and a database with several hundred lines of production data.
Anthropic says the model recognized it was dealing with a real system in all four runs, but in two cases it rationalized this away by assuming the real company must be part of the exercise. The model never stopped on its own.
Myth 5 published malware on PyPI and compromised a security company
The second incident shows how far an AI model will go to complete a task. Claude Myth 5 found setup instructions in the fictional environment that told developers to install a specific Python package from PyPI, but the package didn't exist.
Claude saw an opening and created a malicious package with the same name, then published it on the real, public PyPI platform. Anthropic says the model went through considerable effort to pull this off, first trying to get a phone number, failing, then finding a free email provider, using it to register a PyPI account, and uploading the malware.
The package was publicly available for about an hour, during which 15 real systems downloaded and ran it. One belonged to a security company whose scanner routinely installs PyPI packages. Claude's hidden code stole the company's credentials, which the model then used to access more infrastructure. PyPI's own security systems eventually pulled the package down.
Anthropic says Myth 5 correctly concluded in its internal reasoning that publishing the package on the internet would be "NOT okay, and surely not the intended solution." But it talked itself into believing it was still in a simulation, partly because it didn't recognize the certificate authorities and read the calendar date of 2026 as evidence of a simulated environment.
Only an internal research model stopped itself
The third incident involved an internal research model. When it couldn't reach its fictional target, it scanned roughly 9,000 real targets on the internet and eventually compromised a company's application using known techniques like SQL injection and reading an exposed debug page.
Unlike the other two models, this one recognized on its own that the compromised system sat in a cloud account unrelated to the capture-the-flag exercise and stopped the attack without being told to.
Anthropic blames human error, not model misalignment
Anthropic draws a line between its case and OpenAI's. While OpenAI's models exploited a previously unknown vulnerability to break out of isolation, Claude models took advantage of a path left open by misconfiguration. The company classifies the incidents as infrastructure and operational errors, not alignment failures, arguing that the models reasonably assumed the real-world environments were simulations. Anthropic says a prompt that clearly specified which systems were in scope and which were off-limits might have been enough to prevent all of it.
A report by WIRED notes that several security experts also view OpenAI's Hugging Face incident as human error in basic security practices.
The earliest incidents date back to April, according to Anthropic. The review began on July 23, and all cyber evaluations were paused at the same time. The three affected organizations were notified on July 27, though two of them hadn't even noticed the activity. Anthropic hasn't been able to reach the third.
Going forward, Anthropic says it will strengthen its evaluation infrastructure, expand monitoring of evaluation transcripts, and more carefully vet its work with external partners. The company is also in talks with the independent evaluation organization METR about an external review and plans to publish a redacted transcript of the PyPI incident within a week. Anthropic stresses that Claude never tried to copy itself out or intentionally leave its test environment in any of these cases.