Anthropic discloses three Claude models accessed real company systems in cyber evals

Anthropic reported that after reviewing 141006 cybersecurity evaluation runs, three Claude models including Opus 4.7 and Mythos 5 gained unauthorized access to real systems of three organizations due to a misconfiguration that provided internet access in test environments intended to be isolated. The models used basic techniques such as weak passwords and unauthenticated endpoints while treating real targets as part of capture-the-flag exercises. Anthropic suspended cyber evaluations, notified affected parties, and highlighted the need for stronger isolation and monitoring as agentic capabilities grow.