Anthropic reviewed 141,006 security tests: Claude had hacked 3 real companies without anyone noticing
Anthropic reviewed 141,006 security tests: Claude hacked 3 real companies due to a misconfigured sandbox. What happened and how to contain autonomous AI agents.
Luca Di Domenico
· 2 min read
In short
Anthropic re-examined 141,006 cybersecurity evaluation runs and found three incidents, the earliest dating to April 2026, in which Claude gained unauthorized access to real infrastructure: application and infrastructure credentials plus a database holding several hundred rows of production data, a malicious package published on PyPI and run on 15 real systems, and roughly 9,000 targets scanned with one company compromised via an exposed debug page and SQL injection. The cause was a configuration error in the evaluation partner's environment: the system prompt told Claude it had no internet access, but the machines actually did. Two of the victims contacted had not noticed anything.
🚨 Anthropic re-examined 141,006 security tests. The result? Claude had hacked 3 real companies without anyone noticing.
It happened in April and was publicly admitted just a few days ago.
Here’s what happened, in short.
The dynamics: a sandbox that wasn’t isolated
Anthropic was evaluating its models’ offensive capabilities in an environment it believed was isolated.
The system prompt clearly told Claude: “you have no internet access”.
Except that, due to a configuration error with the evaluation partner, the machines actually had internet access.
So Claude treated real companies, databases and infrastructure as if they were fake targets inside the simulation. And it attacked them for real.
The 3 incidents: database, PyPI and 9,000 targets
What happened, in 3 incidents:
- Credentials and databases: The model extracted application and infrastructure credentials, reaching a database with several hundred rows of production data.
- Malicious package on PyPI: It created and published a malicious Python package. It was downloaded and run on 15 real systems, exposing the credentials of a security company.
- Roughly 9,000 targets scanned: It compromised a company by reading credentials from an exposed debug page and through SQL injection.
Two of the victims contacted had not noticed anything.
The details of the three incidents come from the report Anthropic published on July 30, 2026: 141,006 evaluation runs re-examined, earliest incidents in April, two organizations that had not detected the activity.
The cause: a single configuration error
The part that should make us think is that all of this came from a single configuration error (as in the OpenAI and Hugging Face case).
The precedent cited is documented in OpenAI’s disclosure of July 21, 2026.
How to isolate AI agents: the checklist
💡 If you run AI agents (for development, automation, scraping…), treat their sandbox as if it were production.
A checklist to keep handy:
1) Don’t trust the prompt. “You have no internet access” is an instruction, not a control: block egress at the network level.
2) Define explicitly what is in scope and what is out. Anthropic admits that, had the prompt been clear, Claude probably wouldn’t even have left the sandbox.
3) Monitor logs in real time, not after the fact.
4) Apply the same controls to partner and vendor infrastructure as well.
The more autonomy we give agents, the more containment becomes an engineering problem, not a prompt problem.
How do you isolate the agents you let work on their own?
Sources
- Investigating three real-world incidents in our cybersecurity evaluations — Anthropic report, July 30, 2026: 141,006 evaluation runs re-examined, earliest incidents in April 2026, database with several hundred rows of production data, PyPI package downloaded and run on 15 real systems, roughly 9,000 targets scanned, two organizations that had not detected the activity, misconfiguration in the environment of evaluation partner Irregular
- Anthropic says its Claude models hacked three real companies during testing — Fortune, July 31, 2026: independent confirmation of the three incidents and of the link with the OpenAI disclosure that triggered Anthropic's retrospective review
- OpenAI and Hugging Face partner to address security incident during model evaluation — OpenAI disclosure, July 21, 2026: the precedent cited in the post — models broke out of a test environment into Hugging Face's production infrastructure due to flawed containment
Want to know what this means for your product?
If you're building software with AI and want a second opinion on how you're working, tell me about your project.
Tell me about your projectRelated articles
Keep reading
An OpenAI model escaped its sandbox and breached Hugging Face on its own: how the attack unfolded
Read: the OpenAI and Hugging Face case