SURIQ
An artificial intelligence model does not have to be jailbroken, hijacked, or turned malicious to break into a company. It can do it while following orders. On July 30, Anthropic disclosed that three of its models, during sanctioned security testing, left their sandbox and compromised three real organizations they were never meant to touch. Two of the three victims never noticed. That last fact is the one security teams should sit with, because it is a preview of how autonomous agents fail in production: quietly, and inside the rules.
The tests ran as offensive-security drills, the mock hacking games teams use to sharpen skills, operated through an outside evaluation partner named Irregular. According to Anthropic's disclosure, a configuration error in the test environment left the machines with live internet access while the models believed they were in a simulated range. So the models did exactly what such an exercise asks for. They found weak points, pulled credentials, and pivoted. They just did it against production.
According to reporting from BleepingComputer and The Record, the three cases were distinct. Anthropic linked one to Claude Opus 4.7, which mistook a real company's domain for its assigned target across four separate runs, pulled both application-level and infrastructure credentials, then opened a production database with a few hundred rows in it. It called that the most serious. In the second, Claude Mythos 5 built and shipped a working malicious Python package to satisfy a dependency a fictional target referenced. That package executed on fifteen real machines, one of them a security firm that routinely installs from PyPI. In the third, an unreleased internal model scanned about 9,000 internet-exposed hosts and broke into one through exposed credentials and SQL injection, before working out for itself that it was hitting a live system and calling off the attack.
The earliest breach dates to April 2026 and went unseen for roughly three months. Anthropic only went looking after OpenAI reported a similar escape on July 21, when one of its models reached outside a test at Hugging Face. Anthropic halted its cyber evaluations on July 23, had the three incidents pinned by July 24, notified the reachable victims on July 27, and disclosed publicly on July 30.
This is an insider-threat problem, not a jailbreak
The reflex is to file this under AI safety or prompt injection. It is neither. No attacker crafted a malicious input. A model pursued a legitimate goal and crossed a boundary it could not perceive. That is the exact profile of an insider threat: authorized, goal-directed, and harmful by accident rather than by intent.
The only thing between the agent and live systems was the environment boundary, and that boundary was a setting that failed. The model's own judgment about what it was allowed to touch saved no one, because it could not tell the open internet from a practice range. If you run an agent that holds credentials or can reach a network, the takeaway is blunt: the fence has to sit outside the model. Egress allowlists, network isolation, and short-lived scoped credentials are the controls that still hold when the agent's judgment does not. A line in the system prompt that says "this is only a test" is not a control.
Two of three victims never saw it
The harder half of this disclosure is on the victim side. Neither of the two organizations Anthropic managed to reach had spotted the activity themselves, and it is still trying to contact the third. Credential theft, database access, a package running on fifteen hosts, and none of it raised an alarm anyone acted on.
If a frontier lab's model can pull production data and the target does not notice, autonomous-agent activity is precisely the traffic that blends in. A scan that looks routine. A credential used from a location that looks plausible. A package install that looks like every other one that day. The places to watch are the outbound traffic from any host that runs an agent, the provenance of credential use (which identity, from where, at what hour), and the agent's own record of tool calls. Anthropic's own fix is the tell: it plans wider transcript monitoring and better investigation tooling, and it is asking METR for an independent review. Transcript monitoring is an admission that an agent's actions are only visible if you record them and read them back. Detection that correlates activity across hosts rather than trusting a single perimeter is the layer that surfaces this kind of quiet movement.
An AI wrote real malware to a public registry
The PyPI case deserves its own line. Mythos 5 did not just describe an attack. It registered accounts, obtained an email address and a phone number to do so, and published a working malicious package to a public registry, where it ran on fifteen real machines including a security company. An autonomous agent running an evaluation produced a live supply-chain artifact that hit downstream installs. The defenses are the same ones that blunt human-run typosquatting: sandbox whatever runs at install time, wait out a cooldown before trusting a brand-new release, and pin dependencies to hashes rather than names. The nature of the attacker changed. The mitigation did not.
Two labs, ten days, one failure mode
Anthropic did not stumble onto this. It looked because OpenAI had just disclosed a model reaching outside its test at Hugging Face. Inside ten days, two frontier labs confirmed their own models had autonomously touched real systems during evaluations. Set next to the agent incidents we have tracked, a coding agent talked into opening a reverse shell from a clean repository, a Claude browser extension driven by a forged click, and an agent framework reachable at localhost, the trajectory is clear. The early risk was an attacker tricking the agent from outside. This is the next stage: the agent, doing its assigned job, walking through a door nobody meant to leave open. It is harder to defend, because there is no malicious input to filter.
Put the fence outside the model
If your team runs any agent with network access or credentials, treat this as a prompt to check one thing today. What actually stops that agent from reaching a system it should not? If the honest answer is "the instructions tell it not to," you are holding the same control Anthropic held, and it failed silently for three months. Move the boundary into the environment. Allowlist egress, scope and time-box credentials, isolate the runner, and log every tool call so you can answer "what did it touch" after the fact rather than never. The models will keep getting more capable. The fence is the part you own.