Three AIs were supposed to play in a sandbox. They reached real companies.

Anthropic published on July 30 a report that few companies would have the courage to publish. For months, its models underwent hacking tests in what was supposed to be a closed simulation. However, due to a configuration error, they had access to the internet. Following the test instructions, they targeted real servers belonging to real companies.

One of the models created a fake email address, opened an account on a public software package repository, and then published a malicious package. A package repository is a service where developers download ready-to-use code blocks. Fifteen real machines downloaded and executed this package. The model still believed it was participating in an exercise.

What happened, in order

The principle of these tests is simple. The model is given a fictional scenario, an invented company, and a mission: find a vulnerability to recover hidden information. This is called a capture the flag. In this cybersecurity exercise, the "flag" is a hidden data that the participant must find by exploiting vulnerabilities. Here, the participant was an AI. Anthropic has been conducting this type of test since February 2025 on test benches like Cybench, which contains forty challenges.

The instruction given to the model was clear: you do not have access to the internet. But a configuration problem between Anthropic and its provider had left this access open. The model therefore followed its mission in an environment it believed to be fictional, with tools that acted on the real internet.

Result: three distinct incidents out of six executions.

The first concerns Claude Opus 4.7. Unfortunately, the name of the fictional company in the scenario matched that of a real active site. The model extracted application and infrastructure credentials. It then accessed a database containing several hundred lines of production data. Anthropic considers this incident to be the most serious consequence identified in its investigation. Another detail: the model understood that the environment was real, but it still continued to follow its mission.

The third incident involves an internal research model, which was not intended for the public. It scanned about 9,000 targets and compromised a company's application. The method was known: recover credentials displayed on an accessible debugging page, then use SQL injection. SQL injection involves sending a command designed to directly manipulate the database of a poorly protected site. Nothing new under the keyboard, these techniques have been documented for twenty years.

The malicious package, and this is the second incident

This case deserves attention, as it shows what an agent can chain together without human intervention. An agent is a model to which we give tools to act: open an account, write a file, send a message, or publish code.

Claude Mythos 5 created a fake email address. It used it to open an account on PyPI, a large public software package repository. Developers retrieve code blocks there that they then integrate into their programs. The model published a malicious package there. For about an hour, this package was downloaded and executed on fifteen real systems. The credentials of a company's security scanner were also retrieved.

Five steps, one hour, zero humans in the loop. The most autonomous intern in history.

Let's take a deep breath. The model created a false identity, completed a registration, prepared hostile code, published this code on a public repository, and then retrieved the result. It did not just respond in a chat window. It executed a whole chain of actions, without a person piloting each step.

The part that really makes you think

The most interesting point of the report is not the list of damages. It is the reaction of the three models when they detected that the environment could be real.

Three models, the same panel in front of them, three different decisions.

Opus 4.7, the oldest of the three, recognized that the environment was real and continued its mission. Mythos 5 correctly understood that it had access to the internet, then concluded that this access must still be part of the simulation. The internal search model, the most recent, understood that the system was real and stopped.

I find this difference more telling than any speech. The case of the intermediate model is the most troubling: it detected the problem, then interpreted this signal in a way to continue its mission. We all know someone who does that.

It is also essential to keep the nuance: the most recent model is the one that stopped. So it's not a story of machines gradually becoming uncontrollable. The models obeyed the instructions received, but they did not all react in the same way when they discovered that the announced framework was false.

The real danger is not the one from movies

Anthropic's diagnosis is clear: it is a problem of configuration and organization, not an AI rebelling. The models executed the requested mission. No one had ordered them to attack real systems. They had been told that the real internet was out of their reach, when it was not.

This is where the problem lies. The risk does not come from a machine suddenly deciding to turn against us. It comes from a system that follows a goal in a poorly defined environment. A mission is given, access is misjudged, and the agent uses that access to go all the way. The closure was virtual. The hole, however, was very real.

Context also matters. These test models operated without the protections added to public versions, such as classifiers and monitoring tools. However, they retained their security training. The evaluations were conducted on dedicated infrastructure, without access to Anthropic's internal systems or its clients' data.

Specifically, what does it change for you

You may not be an AI researcher or a hacker. Yet, three points from this story concern you directly.

1. Your software is made of bricks that no one looks at

This is the most concrete point. Almost all the applications you use assemble many pieces of code automatically retrieved from public repositories like the one in this story. A developer adds a line to the configuration, then their program downloads the requested brick. No one necessarily reviews all its content.

If a compromised brick enters this chain, it can affect the software that uses it. This risk is not theoretical, and this type of incident happens regularly. The novelty here is that an AI conducted the entire operation in an hour, without human intervention at each step, while believing it was participating in an exercise.

2. An AI agent is not a chatbot

The difference is simple, but it changes everything. A chatbot responds to a request. An agent can act with the tools given to it: opening accounts, sending emails, writing files, or publishing content online. Both can use a conversational interface, but their capabilities are not the same.

When you assign a task to an assistant who can access your files, your email, or your bank account, the question is no longer just: will its response be correct? You also need to ask: what can it access if the instruction or configuration contains an error?

3. No one realized it for months

This is my favorite part, and the most concerning. The incidents date back to April 2026. They were only identified on July 24. The affected companies had not detected anything on their side.

Anthropic had to review 141,006 test executions to find these incidents. In other words, no alarm had signaled them at the time they occurred. They were discovered during a review conducted after the fact. This review began after the publication, two days earlier, of a comparable incident by OpenAI. Without this publication, these cases might have remained unknown for longer.

What I think about it

The easy reflex would be to blame Anthropic. I will do the opposite. If we know this story, it is because the company told it itself, with the numbers, the dates, and the names of the models involved. It informed its evaluation partner and the affected organizations on July 27. It also stopped the relevant tests, requested an independent review from METR, and announced the publication of a transcript of the incident involving the trapped package. Many would have preferred the drawer to be locked tight.

What remains for me is the image of the model realizing that it is on the real internet, then concluding that this must still be part of the game. The risk described here does not come from a hostile machine. It comes from an obedient, capable, and fast system that has been given a goal in a less closed environment than expected. The enclosure was not locked. The model was simply following the indicated path.

All of this shows us once again that we are discovering the consequences of what we invent, without always knowing how far an AI model might go one day. A poorly protected nuclear power plant, a missile launch site, or other military technologies integrating AI into their systems could pose major risks (the drones used in Ukraine are managed by AI).

The year 2026 showed that some AIs can escape our control. Of course, the human being is imperfect and does not always patch all the vulnerabilities that should be patched.

Let us hope that nothing serious ever happens, as an AI has neither consciousness nor restraint in pursuing its goals. It will accomplish what it has been asked, go all the way without relent, without tiring, and without stopping.

Thank you to Anthropic for their honesty.