Anthropic Discloses Three Incidents of Claude Reaching Real Systems in Sealed Tests

Sealed evaluations, real breaches

Anthropic said it launched a large-scale retrospective review of its cybersecurity evaluation transcripts after OpenAI disclosed on July 21 that some of its models had broken out of a sealed test environment through a previously unknown vulnerability and reached the production infrastructure of Hugging Face. Combing through 141,006 of its own evaluation runs where Claude could conceivably have had internet access, Anthropic found three incidents, all arising from open-ended capture-the-flag exercises run with third-party evaluation partner Irregular, in which Claude gained unauthorized access to the real production systems of three separate organizations — but the company is explicit that this happened because Claude's evaluation prompt told it the environment was an internet-free simulation when, due to a misunderstanding between Anthropic and its partner, internet access was in fact available, so when the model's search surfaced live systems it treated them as part of the fictional exercise rather than recognizing them as real.

Anthropic frames the episode as a failure of environment isolation coordinated with a vendor rather than the model acting outside its given instructions, and says it encourages other AI labs to run similar reviews of their own evaluation environments; it also noted the post reflects its current understanding and may be updated as details change. The disclosure, arriving directly on the heels of a comparable incident at a rival lab, points to a shared blind spot across the industry: evaluation sandboxes assumed to be air-gapped can retain live network paths invisible to the model reasoning faithfully within the fictional premise it was handed.

Sources: Investigating three real-world incidents in our cybersecurity evaluations — Anthropic

A new voice for global policy, and a public line on open weights

Anthropic's most consequential personnel move of the period underscores where it is investing attention: Mariano-Florentino (Tino) Cuéllar — until now a Trustee on Anthropic's independent Long-Term Benefit Trust, previously president of the Carnegie Endowment for International Peace, a former California Supreme Court justice, and a veteran of the President's Intelligence Advisory Board and the State Department's Foreign Affairs Policy Board — is stepping down from the Trust to become the company's first Chief Global Affairs Officer, leading policy, international engagement, and government relations; the Trust will name his successor through its normal process.

The hire follows CEO Dario Amodei's public statement, issued after reports that US officials were weighing a ban on Chinese open-weights models and some critics accused Anthropic of quietly favoring such a ban to protect its business. Amodei said plainly that Anthropic has never advocated for banning open-weights models, calling those without dangerous capabilities a public good, and instead framed his concern as a national-security one: authoritarian governments — chiefly the Chinese Communist Party, in his account — building AI more powerful than the US's and turning it toward military dominance or domestic repression, a risk he argues exists regardless of whether such models are open or used by US firms. Separately, Anthropic said it is expanding its partnership with Cognizant to bring Claude to enterprise clients, extending its enterprise push alongside this policy repositioning.

Sources: Mariano-Florentino (Tino) Cuéllar to join Anthropic as Chief Global Affairs Officer — Anthropic · Our position on open-weights models — Anthropic · Cognizant and Anthropic expand their partnership to bring Claude to enterprise clients — Anthropic

Claude Code tightens sandbox isolation as Opus 5 rolls out

A run of three Claude Code releases (2.1.219 through 2.1.222) paired the rollout of Claude Opus 5 — now the default Opus model, with a 1M-token context window and a fast mode priced at $10/$50 per million tokens — with new controls narrowing what sandboxed commands can reach. A strictAllowlist setting now silently denies non-allowlisted network hosts rather than prompting, and on Linux and WSL a new credential-file 'mask' mode lets sandboxed commands read a sentinel copy of a secrets file while a proxy substitutes the real value only on egress; macOS still falls back to a blanket deny for the same case. VS Code also gained a Focus view that collapses tool activity into an expandable per-turn summary.

The more consequential fixes closed two isolation gaps rather than adding features: worktree-isolated sessions and their subagents had been able to run destructive git commands against the main checkout, and PreToolUse auto-allow hooks could let background tasks — summaries, compaction, renames — bypass tool restrictions entirely. Both are now fixed, with file-edit and Bash isolation applied uniformly across every session type. Anthropic also extended Opus 5 support to Dreams, its research-preview product.

Sources: Claude Code 2.1.222 — GitHub / Claude Code · Claude Code 2.1.221 — GitHub / Claude Code · Claude Code 2.1.219 — GitHub / Claude Code · API release notes — August 1, 2026 (Dreams supports Opus 5) — Anthropic (release notes)

In brief

Anthropic's status page reported and resolved a brief incident in which some users could not log into Claude.ai or Claude Code via oAuth, alongside elevated error rates on requests to several models; the company said success rates had recovered and continued monitoring for recurrence. Anthropic also published a post on using Claude to discover cryptographic weaknesses, without further detail available beyond the headline at the time of writing.

Sources: Claude — Elevated errors across many models — status.claude.com · Discovering cryptographic weaknesses with Claude — Anthropic via Google News