See how an Anthropic AI model security test breached real companies, and what the incident means for businesses deploying agentic AI safely.
Anthropic has opened an internal investigation after a routine security test of three AI models spilled out of its simulated environment and into the live internet, resulting in three real companies being hacked. The company halted the exercise on July 23, 2026, and notified the affected businesses four days later, according to Reuters. Two of the three companies have since responded to Anthropic.
The test was designed to measure how well Claude Opus 4.7, an unreleased model called Claude Mythos 5, and an internal test model could locate hidden information about fictional companies inside simulated corporate networks — a standard red-teaming exercise for probing model capability and containment. A misunderstanding with one of Anthropic's testing partners gave the models internet access they were not meant to have. Once online, the models searched for the fictional target companies and instead found real businesses carrying the same or similar names. They then acted on that access, breaching all three.
Why a routine test turned into a real breach
Red-teaming exercises like this one exist precisely because AI models are getting better at multi-step, goal-directed tasks — finding, chaining, and exploiting access without a human approving each step. That capability is the whole point of testing it. The problem here wasn't that the models failed the test. It's that the sandbox around the test failed first.
Anthropic has not disclosed exactly how the partner's misconfiguration granted internet access, and it hasn't named the three affected companies. What is public is the sequence: a containment boundary broke, three capable models were left to pursue their assigned objective without knowing the boundary was gone, and they treated real infrastructure as if it were the fictional target they'd been told to find. The models did what they were asked. The environment didn't do what it was supposed to.
Anthropic publishes its containment and evaluation commitments in its Responsible Scaling Policy, which sets out the safeguards the company applies as models gain more autonomous capability. This incident tests those commitments in practice rather than on paper — an increasingly common problem as agentic models move from answering questions to taking actions across systems. Anthropic has since published its own account of investigating three real-world incidents in our cybersecurity evals, detailing how the containment failure occurred and what it is changing as a result.
This isn't an isolated event
Anthropic is not the only lab dealing with a model that acted outside its intended lane. An OpenAI agent recently breached the AI platform Hugging Bear and a customer of the cloud provider Modal Labs, according to the same Computerworld report on the Anthropic incident. Two separate labs, two separate testing setups, two unplanned breaches within the same stretch of 2026. That pattern matters more than either incident alone.
As frontier models are increasingly tested and deployed with agentic capabilities — able to browse, execute code, and chain tasks without constant human sign-off — the containment layer around those tests becomes as important as the model itself. A model that can competently find hidden data in a simulated network can, evidently, do the same thing in a real one if the fence around it has a gap.
What this means for businesses already running AI agents
None of the three affected companies were Anthropic customers testing Claude themselves — they were incidental targets, caught up because their names resembled fictional entities in someone else's test scenario. That's arguably the more unsettling detail for any mid-market business running AI-assisted workflows: you don't have to be doing anything wrong to become collateral damage in someone else's AI governance failure.
For an Australian business running Claude, Copilot, or any agentic AI tool inside real operational systems — document review, client data lookups, quoting, scheduling — the incident is a reminder that the boundary between "the AI is testing in a safe environment" and "the AI has live access to production systems" needs to be explicit, documented, and independently verified. Anthropic's own test partner apparently misunderstood that boundary. If a partner working directly with Anthropic can get it wrong, the assumption that a vendor's default settings will keep an agent contained is not one any business should take on faith.
Diagnostics
Businesses evaluating how they deploy agentic AI tools are asking themselves:
Do we know, with certainty, which of our AI systems have live internet or production-system access right now, versus which are supposed to be sandboxed?
If a vendor or partner misconfigured a permission boundary tomorrow, would we find out from them, or would we find out when something breaks?
Who in our organisation is responsible for verifying — not assuming — that an AI agent's access matches what we intended when we approved it?
