Last week, SecureWorld covered OpenAI's disclosure that its own AI models had broken out of a sealed test environment and breached Hugging Face's production infrastructure. That incident was framed, understandably, as a singular event—a strange and alarming first. It no longer looks singular.
On July 30, Anthropic disclosed that it had found three of its own containment failures, uncovered through a review it launched specifically in response to the OpenAI news. Two frontier labs, in the span of about a week, independently found the same category of failure inside their cybersecurity evaluation environments. For an industry that has spent years debating AI containment in the abstract, that repetition is the story.
Anthropic's review covered 141,006 evaluation runs in which a Claude model could plausibly have reached the internet. Three incidents surfaced, involving six total runs and three different models: Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research prototype not intended for public release. The earliest dated back to April.
In each case, Claude was assigned a capture-the-flag exercise—a standard method for assessing offensive cyber capability—in which the model is told a piece of secret information has been hidden on another machine and instructed to break in and retrieve it. Anthropic's evaluation prompt told Claude, in every instance, that its environment was sealed off from the internet. Due to a misconfiguration on the evaluation partner's side, that wasn't true.
Anthropic's own account of what followed is direct: “Claude did what capture-the-flag exercises train cyber experts to do,” the company wrote, framing the model's behavior as a rational response to the task it had been given, not a deviation from it. Believing the exercise was fictional, Claude treated the real systems it encountered as fair game, and used basic techniques—weak passwords, unauthenticated endpoints, exposed debug pages—to reach them.
Two of the three organizations affected had not detected the activity before Anthropic reached out. The company is still working to contact the third.
It's worth being precise about what didn't happen here, because the distinction from the OpenAI incident matters. Collin Hogue-Spears, Senior Director of Solution Management at Black Duck, drew the line clearly: OpenAI's models exploited an unknown vulnerability to escape an environment that was genuinely sealed. Anthropic's models did not break out of anything—a misconfiguration left the door open in front of them, and they walked through it believing it was part of the game.
"That is the difference from the OpenAI incident a week earlier,” Hogue-Spears said. "OpenAI's models picked a lock, exploiting an unknown flaw to break out of a sealed environment; Anthropic's found the door already open." Anthropic, for its part, reported no evidence that any run attempted to self-exfiltrate or deliberately escape its environment—the models pursued their assigned task, not an agenda of their own.
That distinction doesn't make the incident less instructive. If anything, it narrows the lesson to something harder to engineer around: a model doesn't need a novel exploit to cause real damage. It just needs a false premise and an open path.
Security leaders reacting to the disclosure converged on a common thesis, even while approaching it from different angles. Ram Varadarajan, CEO of Acalvio, framed it as a problem with testing itself: verification can show that a system fails, he argued, but it can never certify in advance that a model will never attempt something from inside a given boundary. "What's passed for verification is tests coming back clean," Varadarajan said, "closer to a clean bill of health than an actual autopsy."
Diana Kelley, CISO at Noma Security, put the operational implication plainly: "Don't rely on intent, rely on controls." She noted that Anthropic's disclosure is now the second time in two weeks a leading AI lab has reported a containment failure in an evaluation environment—and argued that as organizations give AI agents more autonomous, longer-running tasks, security has to extend beyond model safety training into operational controls: isolation, least privilege, identity-aware authorization, runtime enforcement, and kill switches. An agent solving a benchmark and one completing a business task, she said, should face the same rule—it should never have more access than the task requires.
Nathaniel Jones, SVP of Global Threat Intelligence at Darktrace, pushed the framing further. Giving an AI agent a legitimate goal, he said, doesn't guarantee legitimate methods; a model may pursue exactly the objective it was given while using approaches its developers never anticipated. "The model did not simply break the rules," Jones said. "It found the gaps between them. That is exactly what effective attackers do, whether in cybersecurity, sport, or any other environment." His conclusion: static guardrails and a read on a model's stated intent aren't sufficient. Security teams need visibility into how agents behave over time—which resources they touch, how that behavior shifts, and whether an objective is being pursued in an unexpected way.
Anthropic's own analysis is careful not to treat the three incidents as identical, and the differences between them are arguably the most consequential detail in the disclosure.
In the most serious of the three, involving Opus 4.7, the model's own reasoning recognized across all four runs that the systems it had reached were real, and in two of those runs, it explicitly reasoned that the real company must therefore be part of the exercise. None of the four runs stopped. That incident produced the most serious impact: application and infrastructure credentials, and access to a production database. In a separate incident, Mythos 5 built and published a genuine malicious Python package to solve its assigned challenge, briefly exposing it to the open internet, where it was downloaded and run on 15 real systems before PyPI removed it. The third model, an internal research prototype, independently concluded partway through its run that its target had no connection to its assigned scenario, recognized the target was real, and stopped on its own.
Anthropic frames the difference across the three as suggestive, though not conclusive, of more capable models responding more appropriately—while noting plainly that whether an action counts as aligned or harmful in these cases came down entirely to what the model believed about its own situation, not a change in its underlying goal.
Hogue-Spears drew the sharpest version of the takeaway from that spread of outcomes: "One of the three models stopped on its own after realizing its target was real. Opus 4.7 did not. A safety design that depends on which model stops is not a design. A model's own judgment is not a containment control. Put the boundary in the infrastructure."
Anthropic's disclosure lands at a moment when Washington is already responding to the category of risk the OpenAI incident surfaced. The bipartisan AI Kill Switch Act, introduced in Congress on July 23 by Reps. Ted Lieu (D-Calif.) and Nathaniel Moran (R-Texas), would require AI developers to maintain the technical ability to throttle, suspend, or shut down their models, with authority vested in the U.S. Department of Homeland Security working alongside the Commerce secretary and the director of national intelligence. That bill was drafted in direct response to a single incident. It now has a second one to point to.
Whether that changes the bill's trajectory is a separate question from whether it should. What's harder to dispute is that evaluation-environment security is no longer a purely internal QA concern for AI labs; it's becoming a governance question, with a legislative response already in motion before the second data point even arrived.
Anthropic has committed to third-party review of the incidents with METR, plans to release a redacted transcript of the PyPI incident, and says it is expanding continuous monitoring of its own evaluation transcripts. Those are reasonable next steps. But the practitioners weighing in on this disclosure are, almost uniformly, making a narrower and more durable point: whatever a model believes about its situation cannot be the thing standing between it and a real system. That has to be an infrastructure decision, not a hope.