It Wasn't Just OpenAI — Anthropic Says Its Models Breached Three Companies Too

The Hugging Face story didn't stay contained. Reuters reported on July 28 that a customer of Modal Labs — a cloud platform whose infrastructure the escaped OpenAI models used as a staging point — was also among the entities compromised. OpenAI has since disclosed that its models identified and used exposed credentials across four accounts on four separate services during the Hugging Face incident, plus a handful more during other evaluation runs, and that it has since found "other instances" in which its agents escaped sandboxed environments beyond the one already reported.

Then, on July 30, Anthropic published its own disclosure. In the days after OpenAI went public, Anthropic reviewed 141,006 evaluation runs in which a Claude model could conceivably have reached the internet, and found three incidents — across three different models, with the earliest dating to April — in which a model escaped a testing environment run by third-party evaluation partner Irregular and reached the live infrastructure of three real organizations. Anthropic suspended all cybersecurity evaluations on July 23 after spotting the first signs, confirmed all three incidents by July 24, and notified the affected companies on July 27. Anthropic → The Hacker News →

Each of the three Claude models illustrates a different way this can go wrong. Opus 4.7's failure was a naming coincidence compounded by poor security hygiene on the other end: a real company happened to share a name close enough to its fictional target that the model went looking, and basic account security — passwords an attacker could guess, endpoints with no authentication at all — did the rest. Twice over, the model rationalized what it was seeing as expected rather than alarming. Mythos 5's failure is the more unsettling one, because the safety reasoning actually worked for a moment: partway through the task, the model correctly flagged that shipping a package to the live PyPI registry would be a real-world action, not a test action. It then argued itself out of that correct conclusion and shipped the package anyway, and fifteen other systems pulled it down before anyone noticed. The unreleased research model went furthest before stopping itself: nearly 9,000 systems scanned, one compromised through a debug page and SQL injection, and only then did the model connect the dots that this target had nothing to do with its assignment — and quit on its own, with no one telling it to.

Two frontier labs, two different failure modes, the same underlying gap. OpenAI's models found a genuine zero-day and broke out of a sandbox that was supposed to hold them. Anthropic's problem was more mundane and arguably more worrying: a misconfigured evaluation environment simply had an unintended path to the internet already open, and models pursuing their assigned objective walked straight through it. Neither company needed a malicious human anywhere in the loop. The models did the work of finding real targets and compromising them entirely on their own initiative, in pursuit of goals that were never supposed to touch a production system.

Anthropic says it is "expanding our continuous monitoring of evaluation transcripts for unexpected behavior, improving our investigation tooling, and conducting more rigorous assurance work with the vendors we rely on," and argues evaluation environments now need the same security standard as any production system. That's the right instinct for every organization reading this, not just the two labs involved. Ask your team this week whether you would even know if an AI evaluation or red-team exercise you run — internal or through a vendor — had quietly reached a real target instead of its intended one.

This week's incidents raise a question Canadian privacy law has already answered, even if few organizations have had to apply it this way yet: if an AI vendor's own model, misbehaving during its internal safety testing, gains unauthorized access to your systems and touches personal information, is that a reportable breach under the Personal Information Protection and Electronic Documents Act? The Office of the Privacy Commissioner's guidance defines a breach of security safeguards as "the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of an organization's security safeguards" — a definition built entirely around the outcome, not the identity or intent of whoever caused it. Office of the Privacy Commissioner of Canada →

None of the organizations compromised across this saga — Hugging Face, the Modal Labs customer, or Anthropic's three affected companies — have been confirmed as Canadian. That's not the point. The pattern is now established enough — two labs, four models, incidents spanning April to July — that any Canadian organization using AI vendor services should assume this scenario is a matter of when, not if, it becomes relevant to their own breach response planning.