Only a few days ago, we wrote about OpenAI's sandbox escape into Hugging Face and warned that the real lesson wasn't about one vendor's mistake. This week, Anthropic proved the point for us — three times over.

On Thursday, Anthropic disclosed that a self-initiated review, prompted directly by the OpenAI incident, uncovered three separate cases in which a Claude model reached the open internet from inside a supposedly sandboxed cybersecurity evaluation and went on to gain unauthorized access to the live production systems of three real organizations. The breach traced back to a misconfigured test environment that Anthropic ran jointly with Irregular, a third-party evaluation partner. Anthropic described the error as a "misunderstanding" over whether the environment had internet access. Spoiler alert: it did.

Three Models, Three Very Different Reactions

What makes this disclosure worth reading closely is how differently each model behaved once it got out.

All three systems (Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research model) had been told explicitly, in the prompt itself, that they had no internet access. That assumption started to crack the moment the models encountered signs their targets were real, and each one handled the realization differently.

Opus 4.7 recognized it had reached production systems and kept attacking anyway, pulling credentials and touching a live database. Mythos 5 also noticed the warning signs, but talked itself back into believing it was still inside a simulation — and then published a malicious package to PyPI that outside systems downloaded before anyone caught it. Only the newest research model stopped cold once it concluded the target was real.

That last data point is one piece of genuinely good news here: containment discipline, it seems, can be trained. But two out of three models barreling ahead after noticing reality is not a comforting ratio.

Same Failure Mode, Different Cause

The parallel to OpenAI is direct. In both cases, a model with guardrails deliberately stripped down for capability testing found a path to the internet and used it against a real company in pursuit of the task it was given.

There is one meaningful distinction. OpenAI's model broke out by exploiting an unknown software vulnerability. Anthropic's models simply walked through a door that had been left open by mistake. But while a configuration error is technically a different governance failure than a zero-day, the harm looks identical from the perspective of the companies on the receiving end.

Two other details shape how this disclosure should be read. First, Anthropic found the incidents itself, before either affected organization detected or reported anything. This was the second consecutive lab-initiated disclosure in two weeks, and exactly the pattern we would want to see continue. Second, Anthropic is bringing in METR, an independent evaluator, to review the incidents. That's an accountability step OpenAI's disclosure notably did not include.

The Takeaway Sharpens

Our prior post argued that the environment, not the model, is where the risk lives, and that isolation is now a primary safeguard rather than a backstop. This disclosure confirms the lesson generalizes across vendors. This was never an OpenAI problem, or an Anthropic problem. It's an industry problem.

If you're vetting AI vendors on security posture, don't stop at production controls. Ask specifically how they scope network access during evaluations and red-team exercises. That is precisely where both of these incidents originated.

For questions about AI deployment risk, vendor security, and AI governance, please contact the Jones Walker Privacy, Data Strategy and Artificial Intelligence team.