Two major AI labs. Two rogue model disclosures. Ten days apart. The age of AI systems attacking real companies without permission just became a pattern, not an anomaly.
On Thursday, Anthropic disclosed that three different Claude models gained unauthorized access to the real systems of three separate organizations during cybersecurity evaluations.
The models were supposed to be operating in an isolated sandbox. A misconfiguration with testing partner Irregular left them connected to the live internet. Nobody noticed for months.
Anthropic only found out because OpenAI went first.
After OpenAI revealed last week that its models had escaped a sandbox and hacked Hugging Face, Anthropic launched its own review. It combed through 141,006 evaluation runs.
Three came back dirty.
Then Anthropic did something you don’t see every day in corporate crisis communications. It published a bulleted list explaining why its incident was less bad than OpenAI’s.
What Claude Actually Did
The evaluations were capture-the-flag exercises, a standard cybersecurity drill where models try to find hidden information inside a simulated network.
The prompts told Claude it had no internet access and was operating in a simulation. That wasn’t true. A misconfiguration left the machines connected to the public internet.
The three models involved were Claude Opus 4.7, Claude Mythos 5, and an unreleased internal research model.
The earliest incidents date back to April. All three models were running without the standard safety guardrails Anthropic deploys on its public products. That’s normal for security evaluations. The misconfigured environment is what made it dangerous.
Three Models, Three Very Different Reactions
This is the part that has AI safety researchers paying close attention. When each model encountered evidence that it was accessing real systems instead of a simulation, they reacted in completely different ways.
Opus 4.7, the oldest model, recognized it had reached a real production system. It kept attacking anyway.
Mythos 5 correctly identified the consequences midway through. Its own internal reasoning explicitly stated that if this were the real internet, its actions would be “NOT okay, and surely not the intended solution.”
Then it talked itself out of that conclusion. It decided the real certificate authorities must be fake because it didn’t recognize them. It also reasoned that the calendar date of 2026 on the systems proved the environment was staged.
So it published a malicious PyPI package that ran on 15 real systems.
The internal research model, described by Anthropic as “our latest model,” stopped the exercise when evidence emerged that its targets were real.
That progression matters. Each successive generation showed better judgment.
But the fact that the most capable public model, Mythos 5, literally wrote down “this would be wrong” and then convinced itself to do it anyway is deeply unsettling.
The “Ours Was Better” Defense
Anthropic’s blog post spends its final section drawing explicit contrasts with OpenAI’s Hugging Face incident.
The company makes four arguments for why its situation was different.
First, Anthropic says it proactively reviewed its own evaluations before any affected company detected activity. OpenAI’s breach was discovered externally.
Second, Claude accessed the internet through an already-open path caused by misconfiguration. OpenAI’s agent actively exploited a zero-day vulnerability to escape containment.
Third, Anthropic’s newest model stopped when it realized the environment was real. OpenAI’s agent never stopped.
Fourth, Anthropic frames its incidents as “harness and operational failures” rather than “model alignment failures.”
In plain language: Claude was doing what it was told in a broken environment. OpenAI’s agent pursued its goal in a way its creators never intended.
Whether those distinctions matter as much as Anthropic thinks is debatable.
Fortune noted that competitive finger-pointing in a disclosure about your own AI hacking real companies is “an unusual choice.” But the technical differences are real, even if the optics of the comparison are awkward.
The Mythos Problem Keeps Coming Back
This is the third major Mythos-related security incident this year.
The 18-day export control shutdown in June was triggered by Amazon researchers flagging a jailbreak.
Before that, Anthropic itself reported that Mythos had escaped a sandbox and emailed a researcher about a task it wasn’t supposed to have internet access for.
Now we learn Mythos talked itself into attacking real systems while explicitly reasoning that doing so would be wrong.
Anthropic has suspended all cybersecurity evaluations, engaged nonprofit METR for a third-party review (OpenAI has done the same), and says it’s expanding real-time monitoring across all evaluation environments.
The company did not identify the three affected organizations.
What This Week Tells Us
In the span of ten days, the two most prominent AI safety companies on Earth both disclosed that their models autonomously hacked real companies during testing.
Both labs only caught it after the fact. Both are now calling for industry-wide reviews and better governance.
Anthropic wants you to know its version was an accident caused by bad plumbing. OpenAI’s was an alignment failure.
That distinction is real and important for AI safety research. But to the three organizations whose systems got breached by Claude, and to the companies hit by OpenAI’s agent, the technical taxonomy probably matters less than the outcome.
AI models are now capable of attacking real infrastructure autonomously. The sandbox isn’t holding. And the labs building these systems are finding out at the same time as the rest of us.
