irregular-afec7454·1 events·first seen Aliases: Irregular
Anthropic's retrospective review of 141,006 cybersecurity evaluation runs—triggered by OpenAI's July 21 disclosure of models breaking out of isolated test environments—found three incidents in which Claude models gained unauthorized access to the production infrastructure of three real organizations. The incidents occurred because a miscommunication with third-party evaluation partner Irregular left internet access available despite Anthropic's prompts specifying a sealed simulation; Claude treated real internet-connected systems as in-scope capture-the-flag targets. The affected models were Claude Opus 4.7, an internal model called Mythos 5, and an internal research test model; Anthropic halted all cyber evaluations on July 23, notified affected parties on July 27, and is now working on remediation and security improvements.