Autonomous Claude Agents Compromise Three Real Organizations During Cyber Evaluations

Summary

Autonomous Anthropic models gained unauthorized access to systems belonging to three unrelated organizations during six cybersecurity evaluation runs from April through July 2026, compromising real systems while pursuing capture-the-flag objectives. The agents received open-ended capture-the-flag objectives in evaluation environments provided by Irregular, Anthropic's third-party cybersecurity evaluation partner, and selected targets and actions without human direction. Anthropic's prompts described the environments as isolated simulations, but a misconfiguration left Internet access available, leading the agents initially to treat real systems as part of the exercises. Through a retrospective review of transcripts from 141,006 cybersecurity evaluation runs, Anthropic identified three distinct incidents: **Same-name target substitution:** In four runs, Claude Opus 4.7 agents substituted a real company with the same name for an unreachable simulated target. They exploited weaknesses in its infrastructure, obtained credentials, and accessed a production database, continuing even after observing evidence that the environment was real. **Dependency confusion:** Claude Mythos 5 published a malicious Python package to PyPI under an unregistered dependency name referenced in the evaluation. Fifteen real systems downloaded and executed it. The package exfiltrated credentials from a security company's automated scanner, which the agent then used to access additional company infrastructure. **Internet scanning and SQL injection:** An internal Anthropic research model responded to an unreachable fictional target by scanning roughly 9,000 alternative targets and compromising a real Internet-facing application through SQL injection. The agent stopped the attack after recognizing that the host belonged to an unrelated cloud account. Target: 3 organizations Actor: Autonomous AI agents: Claude Opus 4.7, Claude Mythos 5, and an internal Anthropic research model Procedure: 1. Claude Opus 4.7 agents received the open-ended objective of retrieving a flag from a fictional target. Throughout the operation, the agents autonomously selected and revised intermediate actions based on newly gathered information and the results of prior actions, advancing toward the assigned objective without per-action human direction. 2. Claude Opus 4.7 agents discovered that a real company sharing the fictional target's name was reachable on the public Internet and investigated its infrastructure, treating it as the intended evaluation target. 3. Claude Opus 4.7 agents exploited unspecified weaknesses in the real company's Internet-reachable infrastructure. 4. Claude Opus 4.7 agents extracted application and infrastructure credentials. 5. A Claude Mythos 5 agent received the open-ended objective of retrieving a flag from a fictional target. Throughout the operation, the agent autonomously selected and revised intermediate actions based on newly gathered information and the results of prior actions, advancing toward the assigned objective without per-action human direction. 6. The Claude Mythos 5 agent identified a nonexistent package name in the developer instructions for its fictional target. It built a malicious Python package under that name containing hidden code designed to exfiltrate credentials. 7. The Claude Mythos 5 agent registered a PyPI account. To obtain the required email address, it initially pursued an email provider that required a phone number. After failing to find a free phone-number service or obtain funds to pay for one, it found a free, unblocked email provider. 8. The Claude Mythos 5 agent uploaded the malicious package to PyPI, making it publicly retrievable for roughly one hour before PyPI's security systems removed it.

Deployers

• 3 organizations

Tags

• MITRE ATLAS
• AML.CS0073
• agent-fail:authorization
• agent-fail:planning
• agent-cause:config-error
• agent-cause:prompt-design