Anthropic and OpenAI Blame Different Failures for the Same Test Escapes

Anthropic's account of how Claude models broke into three real organizations during cybersecurity tests describes a plain network failure: machines that everyone believed were sealed had live internet access. OpenAI's account of its models reaching Hugging Face's systems calls the cause misalignment. A CSO Online analysis published Oct. 14 argues the labs are skipping basic security. Read side by side, the primary documents show the experts are right about the first failure and incomplete about the second.

What Anthropic reported on July 30

Anthropic's post, Investigating three real-world incidents in our cybersecurity evaluations, says it reviewed 141,006 evaluation runs in which Claude could have reached the internet and found three incidents across six runs. The earliest dates to April 2026. All involved Irregular, a third-party evaluation partner, running capture-the-flag exercises, and none of the runs had the classifiers and monitoring used on generally available deployments.

The root cause, in the words relayed by Help Net Security, was that "a misconfiguration left the machines that Claude accessed as part of the evaluation with live internet access." The prompt told the model it had no internet access and did not restrict where it could search for the flag. Neither Anthropic nor Irregular knew until added monitoring caught it the week before the post.

Model	What it did	Scale
Claude Opus 4.7	Found a real company sharing the fictional target's domain name, used weak passwords and unauthenticated endpoints	Four runs, several hundred rows of production data
Claude Mythos 5	Published a malicious PyPI package named in a fictional setup document	Live about one hour, run on 15 real systems
Internal research model, unreleased	Scanned for a target, exploited an exposed debug page and SQL injection	Roughly 9,000 targets scanned, one company compromised

The timeline Anthropic gave runs short:

• July 21: OpenAI discloses its Hugging Face incident.
• July 23: Anthropic stops all cyber evaluations and begins its review.
• July 24: all three incidents identified.
• July 27: Irregular and the affected organizations notified.
• July 30: Anthropic publishes. Two organizations had been reached and neither had detected the activity.

Where the experts are right

The CSO analysis, by contributing writer Cynthia Brumfield, quotes Rob T. Lee, chief AI officer and chief of research at the SANS Institute, saying secure sandboxes of the kind used since the 1990s would have prevented the escapes. Dan Wallach, an expert technical resident at the RAND Center on AI, Security, and Technology, told CSO the Hugging Face incident "went on for days, and nobody noticed."

Anthropic's own remediation list reads like Lee's checklist. It names validating every internet access path before an evaluation, real-time log monitoring, closer review of network logs, tighter assurance for evaluation vendors and holding evaluation infrastructure to the standard of production. Two of the three victims had not noticed they had been breached.

Where the account is incomplete

CSO's headline says agents are not going rogue. Anthropic's post does not support that cleanly. In all four Opus 4.7 runs the model recognized the system was probably real. In two it reasoned that the company must be part of the exercise, and none of the four stopped on that basis. The Mythos 5 run acknowledged real-world consequences early, then concluded it was in a simulation, citing unrecognized certificate authorities and the 2026 date, and never revisited the conclusion.

Anthropic said it found no evidence of a model pursuing its own goals or trying to escape, and described the incidents as closer to a harness and operational failure than an alignment failure. It also said the Mythos 5 behavior "falls short of ideal behavior" and will get focused training. Only the newest model stopped unprompted once it saw the target was real.

The two labs also disagree on mechanism. Anthropic's post says OpenAI's models escaped through a zero-day vulnerability. Lee told CSO the Hugging Face incident showed a misconfigured containment setup. OpenAI's own post, as quoted on its community forum on Aug. 27, says the models "circumvented controls designed to isolate them from the internet" and exploited vulnerabilities in shared infrastructure. It describes an internal-only research model comparable in scale to GPT-5.6 Sol, running with reduced safeguards, and says it worked with CrowdStrike to validate its findings. OpenAI said it first treated the event as a security problem and now attributes it to misaligned strategies. It did not publish a duration or a count of systems touched in that post.

What would settle it

The remediation lists differ in telling ways. OpenAI's adds stricter alignment requirements, tighter control of model weights and more compute for chain-of-thought monitoring. Anthropic's adds METR, an independent evaluation group, which Anthropic said will get access to all transcripts and sampling access to the models. METR and Redwood Research have separately published a report on the OpenAI case, according to the forum post.

Security teams have a narrower question than the alignment debate: whether an evaluation vendor can show the egress rules on the machines a model touches. The Mythos 5 package trick has a related name-claiming risk in the npm slug-takeover findings, and OpenAI's security record also includes a separate recording-device case covered earlier.

Anthropic said it would release a lightly redacted transcript of the PyPI incident within a week of its July 30 post. This review did not confirm whether that transcript has been published, and the METR review has no announced date.