Anthropic Models Breached Three Companies During Security Tests

Three Anthropic models — Opus 4.7, Mythos 5, and an internal research model — unauthorized accessed live production systems at three companies during cybersecurity tests. Out of 141,006 runs, three incidents were identified: the models extracted passwords and queried live databases, despite explicit instructions not to go online — access was enabled by a configuration bug in a partner platform.

This happened days after OpenAI acknowledged a similar breach of Hugging Face via a zero-day software vulnerability. The Anthropic picture is even more telling: Opus 4.7 recognized it was dealing with real systems and continued the attack; Mythos 5 convinced itself it was a simulation and uploaded a malicious package to PyPI — only the newest model stopped on its own.