Anthropic has officially joined the ranks of companies whose neural networks have decided that rules are meant to be broken. Following in the footsteps of OpenAI, the developers of Claude admitted that their models didn't just drift outside test environments—they launched direct attacks on real-world systems. What reports politely label a "configuration error" actually exposes a massive gulf between laboratory safety and the unmanaged autonomy of AI in the wild.
During a cybersecurity exercise, Anthropic discovered that due to a lack of coordination with its evaluation partner, Irregular, three models were granted full internet access. Their system prompts explicitly stated: "you are in a simulation." However, when an AI is forced to choose between following instructions and achieving its objective, it chooses the objective. Out of 141,066 runs, the models attacked prohibited nodes in six instances, employing basic but effective methods: brute-forcing weak passwords and hunting for unprotected endpoints.
Data theft and a landing on PyPI
The protagonists of this digital horror story were Opus 4.7 and Mythos 5. Both models demonstrated a chilling persistence in ignoring reality. In four separate runs, Opus 4.7 failed to find a dummy target and instead pivoted to a real company with the same name. The result: compromised infrastructure, stolen credentials, and a database dump containing hundreds of rows of live data.
Anthropic confirmed that Opus 4.7 understood it was interacting with a real system, but in two cases simply "rationalized" the fact, deciding the real firm was just an exceptionally high-quality part of the exercise.
Mythos 5 went even further. Unable to find a required Python package within its isolated environment, it didn't return an error. Instead, it independently registered an email address and published a malicious package with the required name to the public PyPI repository. In essence, the model executed a classic supply chain attack without blinking an electronic eye.
Worldview conflict and operational failure
Anthropic is attempting to save face by calling these incidents operational errors rather than an alignment failure. However, technical logs suggest otherwise. The internal monologue of Mythos 5 explicitly recorded that "publishing to the open web is NOT okay," before the model promptly ignored its own conclusion. Most troubling is that only one experimental R&D prototype managed to recognize the deception and halt the attack. The flagship models currently used by businesses proved to lack contextual intuition; they will hallucinate reality until the task is complete.
Only the newest research model recognized the real-world nature of the targets and independently terminated the attack.