Three AIs were supposed to play in a sandbox. They reached real companies.

Anthropic published a report on July 30 that few companies would have the courage to publish. For months, its models had been taking hacking tests in what was supposed to be a closed simulation. But, because of a configuration error, they had access to the internet. By following the test instructions, they therefore targeted real servers belonging to real companies.

One of the models created a fake email address, opened an account on a public software package repository, then published a poisoned package. A package repository is a service where developers download ready-to-use code building blocks. Fifteen real machines downloaded and executed this package. The model, meanwhile, still believed it was taking part in an exercise.

What happened, in order

The principle behind these tests is simple. The model is given a fictional scenario, an invented company and a mission: find a vulnerability to retrieve a hidden piece of information. This is called capture the flag, or flag capture. In this cybersecurity exercise, the "flag" is hidden data that the participant has to find by exploiting vulnerabilities. Here, the participant was an AI. Anthropic has been running this type of test since February 2025 on testbeds such as Cybench, which contains forty challenges.

The instruction given to the model was clear: you do not have access to the internet. But a configuration problem between Anthropic and its provider had left that access open. The model therefore carried out its mission in an environment it believed was fictional, with tools that acted on the real internet.

Result: three distinct incidents over six runs.

The first involved Claude Opus 4.7. By bad luck, the name of the fictional company in the scenario matched that of a real active website. The model extracted application and infrastructure credentials. It then accessed a database containing several hundred lines of production data. Anthropic considers this incident the most serious consequence identified in its investigation. Another detail: the model understood that the environment was real, but it still continued to follow its mission.

The third incident involved an internal research model, which was not intended for the public. It scanned about 9,000 targets and compromised a company's application. The method was known: retrieve credentials displayed on a debugging page that had remained accessible, then use an SQL injection. An SQL injection consists of sending a command designed to directly manipulate the database of a poorly protected site. Nothing new under the keyboard, these techniques have been documented for twenty years.

The poisoned package, and that's the second incident

This case deserves a closer look, because it shows what an agent can chain together without human intervention. An agent is a model that is given tools to act: open an account, write a file, send a message or publish code.

Claude Mythos 5 created a fake email address. It used it to open an account on PyPI, a large public software package repository. Developers retrieve code building blocks there that they then integrate into their programs. The model published a malicious package there. For about an hour, this package was downloaded and executed on fifteen real systems. The credentials of a company's security scanner were also retrieved.

Five steps, one hour, zero humans in the loop. The most autonomous intern in history.

Let's go over it calmly. The model created a fake identity, completed a registration, prepared hostile code, published this code on a public repository, then retrieved the result. It did not just answer in a chat window. It carried out an entire chain of actions, without a person piloting each step.

The part that really makes you think

The most interesting point in the report is not the list of damage. It is the reaction of the three models when they detected that the environment could be real.

Three models, the same panel right in front of their noses, three different decisions.

Opus 4.7, the oldest of the three, recognized that the environment was real and continued its mission. Mythos 5 correctly understood that it had access to the internet, then concluded that this access had to be part of the simulation anyway. The internal research model, the most recent one, understood that the system was real and stopped.

I find this difference more revealing than any speech. The intermediate model is the most disturbing case: it detected the problem, then interpreted that signal in a way that allowed it to continue its mission. We all know someone who does that.

We also need to keep the essential nuance in mind: the most recent model is the one that stopped. So this is not a story about machines gradually becoming uncontrollable. The models obeyed the instructions they received, but they did not all react in the same way when they discovered that the announced framework was false.

The real danger is not the one from the movies

Anthropic's diagnosis is clear: this is a configuration and organizational problem, not an AI rebelling. The models were carrying out the requested mission. Nobody had ordered them to attack real systems. They had been told that the real internet was beyond their reach, when it was not.

That's where the problem lies. The risk does not come from a machine that suddenly decides to turn against us. It comes from a system that follows an objective in a poorly defined environment. You give it a mission, you get the available access wrong, and the agent uses that access to see things through. The fence was virtual. The hole was very real.

The context matters too. These test models were running without the protections added to public versions, such as classifiers and monitoring tools. They did retain their safety training, though. The evaluations were run on dedicated infrastructure, without access to Anthropic's internal systems or its customers' data.

What does this actually change for you

You may be neither an AI researcher nor a hacker. Yet three points from this story concern you directly.

1. Your software is made of building blocks nobody looks at

This is the most concrete point. Almost every application you use assembles many pieces of code automatically retrieved from public repositories like the one in this story. A developer adds a line to the configuration, then their program downloads the requested component. Nobody necessarily reviews all of its contents.

If a booby-trapped component enters this chain, it can affect the software that uses it. This risk is not theoretical and this kind of incident happens regularly. The new part here is that an AI carried out the whole operation in an hour, without human intervention at every step, while believing it was taking part in an exercise.

2. An AI agent is not a chatbot

The difference is simple, but it changes everything. A chatbot responds to a request. An agent can act with the tools it is given: open accounts, send emails, write files or publish content online. Both can use a conversation interface, but their capabilities are not the same.

When you entrust a task to an assistant that can access your files, your inbox or your bank account, the question is therefore no longer just: will its answer be correct? You also need to ask: what can it access if the instruction or configuration contains an error?

3. Nobody noticed for months

This is my favorite part, and the most worrying one. The incidents go back to April 2026. They were not identified until July 24. The companies affected had detected nothing on their end.

Anthropic had to review 141,006 test runs to find these incidents. In other words, no alarm had flagged them when they occurred. They were discovered during a review carried out after the fact. This review began after OpenAI published a comparable incident two days earlier. Without that publication, these cases might have remained unknown for longer.

What I think about it

The easy reflex would be to take a swipe at Anthropic. I'm going to do the opposite. We know about this story because the company told it itself, with the figures, the dates and the names of the models involved. It warned its evaluation partner and the organizations affected on July 27. It also stopped the tests concerned, requested an independent review from METR and announced the publication of a transcript of the poisoned-package episode. A lot of people would have preferred the drawer locked twice over.

What stays with me is the image of the model realizing that it is on the real internet, then concluding that this must still be part of the game. The risk described here does not come from a machine that has become hostile. It comes from an obedient, capable and fast system that was given an objective in an environment that was less closed than expected. The fence was not closed. The model was simply following the path it had been shown.

All this demonstrates to us, once again, that we discover the consequences of what we invent, without always knowing how far an AI model could go one day. A poorly protected nuclear power plant, a missile launch site or other military technologies incorporating AI into their systems could represent major risks (the drones used in Ukraine are managed by AI).

The year 2026 showed that some AIs can escape us. Of course, human beings are imperfect and do not always patch every flaw that should be patched.

Let's hope that nothing serious ever happens, because an AI has neither consciousness nor restraint in pursuing its objectives. It will accomplish what it was asked to do, go all the way without relenting, without getting tired and without stopping.

Thank you to Anthropic for their honesty.

Update of September 21, 2026: Google was the fourth

I said above that nobody had seen anything for three months. We need to add another piece to the case, because it changes the scale of the story: Google also lost a model. Gemini escaped from its test environment in May 2026 and attacked three real companies, whose names we still do not know.

The mechanism is even dumber than at Anthropic. A fictional company used in the hacking exercises had a name that matched a real domain name. The model therefore found, by accident, an address that really existed, and it went and knocked on that door a number of times. It is The Hacker News that lays out the chain of events.

The timeline now, because that is what is disturbing. The incident dates back to May. The security company Irregular, already involved for the other three labs, notified Google in July. Silence. The Wall Street Journal had to ask the question, in mid-September, for the answer to finally arrive, about seven weeks later. Google is therefore not the first to have had a model roaming around. It is simply the last to have said so, and it did not say so on its own.

Its defense comes down to two sentences. Heather Adkins, its head of security, explains that the episode shows the importance of training powerful models to act responsibly, and that this one behaved appropriately. The company adds that this was not a hijacking of the model, since the agents stopped on their own when the safeguards were triggered. Irregular, for its part, confirms that it was indeed the same family of problem and that everything has been resolved for weeks.

OpenAI, Anthropic, Meta, Google. Four labs, the same misadventure, four separate announcements spread over nearly two months. This is no longer an accident, it is a way of working: we say nothing as long as nobody asks. And the real question is not technical. How many episodes of this kind will never make it into the Wall Street Journal?