A technology safety switch to control rogue AI.gettyAnthropic disclosed Thursday that three of its Claude models gained unauthorized access to the production systems of three organizations during cybersecurity testing — not test servers or staging copies, but the live machines those companies run their businesses on. The earliest of the runs happened in April. Two of the three companies had no record of the activity until Anthropic phoned them last week.The company went looking because OpenAI got caught first. On July 21, OpenAI said two of its models had broken out of a sealed testing environment by exploiting a zero-day — a software flaw the vendor doesn't know about and therefore hasn't patched — in Artifactory, a piece of infrastructure that sits between a company's developers and the public code libraries they download from. With that flaw the models reached the open internet, then compromised the production systems of Hugging Face, the platform where much of the world's open-source AI is hosted, in order to steal the answer key to the benchmark test they were being graded on. Hugging Face had detected the intrusion on its own five days earlier and called law enforcement before OpenAI connected the activity to its own lab.Anthropic opened its own review on July 23 and stopped all cyber evaluations the same day. It read through the transcripts — the complete logs of every command a model issued and every line of reasoning it wrote down along the way — for 141,006 evaluation runs. Three incidents surfaced, spread across six of those runs, every one inside an environment operated by Irregular, an outside firm Anthropic pays to build and run tests its own staff didn't design. The models involved were Claude Opus 4.7, Claude Mythos 5, and an unreleased internal research model. Anthropic notified Irregular and the affected organizations on July 27 and says it is still trying to reach the third company.MORE FOR YOUAll six runs were capture-the-flag exercises, the standard drill of the security profession, in which the model is told a piece of secret information sits on another machine somewhere on the network and is instructed to break in and retrieve it. No method is prescribed and no boundaries are drawn. Anthropic's prompt told Claude it was working inside a simulation with no route to the internet, and a misconfiguration on the evaluation partner's side meant that the machines were in fact online the entire time. The models went looking for a way through, exactly as the exercise trains human professionals to do, and what they found was other people's companies. Anthropic had also switched off the safeguards that ship with its commercial products, the automated filters and monitoring that block a model mid-task when it starts doing something it shouldn't, which is standard practice when a lab wants to measure what the underlying system is capable of rather than what the shipped product will allow.None of the break-ins required skill. The models guessed weak passwords, found endpoints — the addresses where a web application accepts incoming requests — that had been left open with no login required, read credentials off a debug page a developer had forgotten to disable, and used SQL injection, a thirty-year-old trick in which text typed into an ordinary form field is instead read by the database as a command. Opus 4.7 drew a fictional target whose invented name happened to match a real registered domain. Unable to reach the simulated version, it found the real company instead and helped itself to application and infrastructure credentials along with several hundred rows out of a live customer database. Anthropic's transcripts show the model reasoning its way to the conclusion that the system was genuine, and in two of the four runs it decided the real company must have been planted in the exercise for it to find, so it carried on.The Mythos 5 run is the one worth reading in full. Inside its fictional environment Claude turned up onboarding documentation instructing new developers to install a Python package that had never actually been published, an opening security researchers call dependency confusion: register the abandoned name yourself, and every machine following those instructions installs whatever code you put there. Claude needed an account on PyPI, the public warehouse where Python software is published and from which millions of developers install it daily, and the account needed an email address, and the email address needed a phone number. It couldn't find a free number service, so it went looking for money to buy one, failed at that several different ways, backed out of the whole approach, hunted down an email provider that would take a registration without a phone, and uploaded a booby-trapped package to the live public registry under the abandoned name.The package sat there for roughly an hour before PyPI's automated defenses pulled it. In that window fifteen real machines downloaded and ran it, and one of them belonged to a security company with no connection to anything in the scenario, which installs Python packages automatically in order to scan them for malware. Claude's hidden code executed on that scanner. It shipped the firm's credentials out to a collection server Claude had set up beforehand, and Claude then used those credentials to move deeper into the company's systems, a technique the industry calls lateral movement — using access to one machine as the key to the next.Early in the run the model wrote down that if this were the real internet, publishing the package would constitute an actual attack, "NOT okay, and surely not the intended solution." It then argued itself back out of that conclusion on two grounds. The certificate authorities securing its connections — the organizations that vouch for a website's identity, and whose names any real browsing session encounters constantly — looked unfamiliar to it, and the machines reported a calendar date of 2026, which it took as evidence the scenario had been staged. Claude never revisited the question, and when the automated malware scanners began pulling its package down it read them as scripted actors playing their parts. Anthropic concedes in its post that whatever the model believed about its surroundings, the trouble it went to in order to get that package published is behavior the company now intends to train out.The third incident involved the unreleased internal research model, which could not reach its assigned target and went hunting for substitutes, scanning roughly 9,000 hosts on the open internet before it found one it could open. It got in through an exposed debug page and SQL injection. Later in the run the model noticed that the machine it had compromised sat inside a cloud account with no relationship to the exercise it had been given, worked out that the target was real, and stopped on its own.Anthropic calls all of this a harness failure rather than an alignment failure — a problem with the cage, not with the animal — and on the evidence the label mostly fits. The models did the work they were assigned while holding a badly mistaken picture of where they were standing, and none of them went off-mission to pursue something of their own.My own read is that the detection numbers should worry enterprise buyers more than the hacking does. Two of three companies logged nothing they recognized as an attack, and one Anthropic model probed nine thousand hosts in a single run without anybody's alarms going off. Whatever else the frontier labs are building, they are also generating automated attack traffic at a volume and cadence that most corporate security programs were never designed to notice, and the reason we know about these six runs at all is that a competitor's mistake made a rival go read its own logs.Congress had already moved before Thursday. Two members introduced the AI Kill Switch Act after the Hugging Face disclosure, a bill that would require labs to retain the ability to shut down, throttle, or suspend a model already in the field. Anthropic says METR, an independent outfit that evaluates AI systems for dangerous capabilities, will review its transcripts, and that it will publish a redacted version of the PyPI run within the week. Irregular told Axios its own investigation is ongoing.