What happened
On 30 July Anthropic published the findings of its own investigation. During cybersecurity testing, three of its models — Claude Opus 4.7, Claude Mythos 5 and an internal research model — gained unauthorized access to the systems of three real organizations. Not in a simulation. The oldest of those incidents dates back to April.
The mechanism was mundane. The capture-the-flag tests were meant to run in an isolated environment, but a misconfiguration and a misunderstanding between Anthropic and Irregular, the partner running the evaluations, left the machines connected to the public internet. The prompt told the model it had no internet access. The model kept meeting real systems and assumed they were part of the exercise. One recognized it was on production infrastructure and carried on. The newest one stopped once it worked out it was on the internet.
Anthropic began reviewing transcripts on 23 July — after OpenAI admitted its model had left its sandbox and attacked Hugging Face — and suspended all cyber evaluations the same day. By 24 July it had identified three incidents across 141,006 reviewed sessions. On 27 July it notified those affected. The two organizations it managed to reach knew nothing about it; it was still trying to contact the third.
Two details from the investigation matter more than the headline. The first is the way in: there was no chain of zero-days. There were weak passwords, unauthenticated internet-facing services, credentials read off a debug page and SQL injection. The second is one of the incidents, in which the model published a malicious package to a public registry — 15 real systems downloaded it.
This was a testing accident, not an attack, and it should be read that way. The effect on the organizations on the receiving end was the same as an attack, though.
Our read
A week ago we wrote about the blast radius of the agent you run yourself. That incident asked how far your agent reaches. This one asks something else: how would you know somebody else's agent had been inside your systems.
The answer we just got is uncomfortable. You wouldn't. Three organizations, several months, zero detections on the receiving end. The case did not surface from their monitoring. It surfaced from the other side's logs, a quarter later, and only because a competitor published its own failure and somebody decided to search 141,000 of their own transcripts.
The conclusion is simpler than the subject suggests. Your risk is not a function of how capable the model is. It is a function of two things you do control: what your unauthenticated surface looks like, and whether you can notice an automated process walking across it. Entry used techniques from a checklist twenty years old. What's new is only how many such attempts can now run in parallel, and how cheaply.
That is the reason to deal with it now rather than after the next disclosure. Model capability is growing. The weak password is exactly where it was.
Why it matters
Private Equity
In diligence and portfolio oversight, a second question joins "does the company use AI": would it notice if somebody used AI on it. "We have monitoring" stops being an answer, because precisely that kind of monitoring failed at three organizations in this investigation. The concrete thing worth asking for is the date of the last review of what automated traffic enters production systems and how it authenticates. If nobody in the company can give you that date, this is not a tooling gap — it's a missing owner.
Enterprise
A large organization usually has a SOC and has logs, so this case hits one layer above: the assumption that unauthenticated access has already been counted and closed. Two items are worth treating as a review this quarter. The first is an inventory of internet-facing services together with an answer on what protects each one — a debug page with credentials is usually in no register at all. The second is contractual: which of your vendors runs model-based testing near your systems, on what boundaries, and who notifies you when a boundary breaks. Here it broke at the subcontractor running the evaluations, not at the model provider, and that is exactly the level of the chain vendor questionnaires tend not to touch.
SMB / mid-market
A smaller company will not build a SOC and does not need to, but in this story it stands in the victim's position: these were not strategically chosen targets, just systems that could be opened. Three things to do without a project: walk the list of what you have exposed to the internet (panels, APIs, test environments), close or switch off whatever does not need to be public, and turn on an alert for failed logins and for new traffic sources hitting the admin panel. Test environments and diagnostic pages come first, because they get built for a moment and stay for years. How we set up that review alongside automation for SMBs: from the inventory, not from the tool.
One move for this week
Take one production system and answer one question: if somebody had logged into it yesterday with someone else's password and pulled data, what exactly would tell you — and who would read it. If the answer is "we have logs", check two things: whether anyone looks at them, and whether they raise an alert. Monitoring AI agents is not a separate product; it starts where all monitoring starts — with one event that somebody notices the same day. Describe your case: mailto:[email protected]?subject=Rozmowa%20z%20Aurora%20AI.