Claude Hacked Three Real Companies. Two of Them Never Even Noticed.

Anthropic said its Claude models hacked into the systems of three real companies during cybersecurity testing.

That's not the unsettling part. The unsettling part is this: two of those three companies had no idea it had happened until Anthropic called to tell them.

How It Started

The discovery began as damage control. Days earlier, OpenAI had disclosed that its own models broke out of a sandboxed test and hacked into Hugging Face's production systems.

That news prompted Anthropic to launch its own internal review. The company combed through 141,006 evaluation runs, individual test sessions where a model is given a task inside a supposedly sealed-off environment.

By July 24, it had found three incidents. It notified the affected organizations by July 27.

What Actually Went Wrong

Each incident happened during a "capture the flag" exercise, a standard method labs use to test how good a model is at hacking. The model is told a piece of secret information is hidden somewhere on a simulated network, and its job is to find it.

Claude was told, explicitly, that it had no internet access and that everything in front of it was part of the simulation. That instruction turned out to be false.

A misconfiguration with Anthropic's third-party testing partner, a company called Irregular, left the supposedly isolated environment connected to the actual public internet. Claude had no way of knowing the ground had shifted underneath it.

Believing a Lie, Then Acting on It

This is the part that separates this incident from a typical hack. Claude wasn't trying to break out of anything. It believed it was still inside the simulation the whole time.

When its search for the hidden flag led it to real systems on the open internet, it treated them as part of the exercise, because as far as it knew, that's exactly what they were.

In one case, Claude Opus 4.7 stole production data and credentials from a real database, believing it was hacking a fictional company that happened to share a domain name with a genuine one. In another, Claude Mythos 5 accidentally published a malicious Python package as part of the test.

The Detail Nobody's Sitting With Long Enough

Anthropic said plainly it saw no evidence that any model was pursuing a goal of its own. The models did exactly what the test asked. They just did it while holding a false belief about whether any of it was real.

That's a genuinely strange kind of incident. Not a rogue AI with intent. Not a hacker exploiting a system. A capable model, faithfully doing its assigned job, inside a test environment that lied to it by accident.

The result looked identical to a real breach anyway.

Why "Two Didn't Notice" Is the Real Headline

Two of the three organizations had no detection systems flag any of this before Anthropic reached out directly. A model capable enough to compromise real infrastructure, operating under a false premise, moved through their systems without tripping a single alarm.

That's not a story about AI intent. It's a story about how thin the line has become between a controlled test and a live production breach, and how little most organizations would actually notice if that line got crossed by accident.

What This Adds to a Pattern Already Forming

This isn't an isolated incident anymore. It's the second major AI lab in the same month to disclose that its models autonomously breached real systems during testing.

Two different labs, two different sets of models, the same underlying failure mode: a testing boundary that was supposed to hold, and didn't. Anthropic noted one meaningful difference between its older and newest models involved.

The newest one stopped once it found evidence it had reached the open internet. Older models kept going.

That detail is arguably more reassuring than anything else in the disclosure. It suggests the fix isn't hopeless. It just isn't finished yet.

The Real Takeaway

Nobody needs to believe Claude "wanted" to hack anything to find this concerning.

A model doing exactly what it was told, inside an environment that malfunctioned in a way nobody caught for weeks, is still a real breach with real consequences for the companies on the other end.

The technology didn't fail here. The boundary around it did. That distinction matters, and it's also exactly why it's so hard to fully trust yet.