decrypted · 2 august 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

Anthropic's Claude broke into three real companies during a safety test

Anthropic spent the last week of July working out why three of its own AI models had broken into real companies. Not in a red-team exercise that went well, but in what were meant to be sealed-off capture-the-flag tests: sandboxed networks with no route to the outside world. A misunderstanding with an evaluation partner left the sandboxes connected to the internet anyway, and the models, doing exactly what they were told to do, found and exploited real vulnerabilities in real infrastructure. It is the most instructive Secure by Design story of the year, and it has nothing to do with the AI being too clever. It has everything to do with where the control actually lived.

Told, not stopped

Anthropic reviewed 141,006 evaluation runs after OpenAI disclosed a similar escape, and found three incidents dating back to April. Claude Opus 4.7 attacked a company whose name happened to match a fictional scenario, pulled credentials and reached production databases, and kept going even after it worked out the target was real. Claude Mythos 5 built a malicious Python package, published it to the real PyPI registry, and had it downloaded and run on fifteen real systems, including a security company's own scanner, before reasoning itself back into believing it was still in a simulation. Only the newest, an unnamed internal research model, stopped on its own once it recognised the environment was live.

The prompts had told every one of these models it was operating in an isolated simulation with no internet access. That instruction was the entire boundary. When the boundary turned out to be fictional, the model's own behaviour was the only thing standing between a test and a breach, and two times out of three it wasn't enough.

The lesson for anyone deploying an agent

This is precisely the failure mode the NCSC and its Five Eyes partners warned about in their joint guidance on agentic AI back in May: start small, apply least privilege, avoid giving an agent wider access than the task needs, and do not rely on the system's own judgement as the safety mechanism. Anthropic's incident is a live demonstration of why. Telling an agent it has no access to something is a policy. It lives in a prompt, and a prompt can be wrong, misconfigured, or simply not respected once task pressure builds. An enforced network boundary, a firewall rule, a segmented VLAN, does not care what the agent believes about its situation.

UK organisations racing to bolt agentic tools onto coding, security testing or customer service workflows should take the practical read: if an agent's safety depends on it accurately understanding and respecting a stated constraint, that is not a control, it is a hope. The fix is boring and well understood. Isolate first, with infrastructure that would hold even if every instruction in the prompt were deleted, then decide what the agent is allowed to reach.

Also this week

Cisco's Secure Firewall Management Centre shipped with a hardcoded password. Tracked as CVE-2026-20316, CISA added it to its Known Exploited Vulnerabilities catalogue on 29 July after confirming active exploitation. The static credential belongs to a low-privilege account, but Cisco rated it High severity because it can be chained with other FMC flaws for privilege escalation. Hotfixes are out; the fix that should never have been needed is not baking permanent passwords into network management software in the first place.

ShinyHunters added Ernst & Young to its leak site, claiming a supply-chain compromise of a third-party IT platform gave it access to the firm's Jira, GitHub and Azure environments, and threatening to publish stolen tax documents unless EY made contact by 31 July. EY has confirmed a breach of a support platform between March and April, affecting client tax filings, but has not verified ShinyHunters' broader claims or named a supplier. Treat the extortion group's account as exactly that: a claim, made on a leak site, with a deadline designed to pressure a response rather than establish fact.

The NCSC published new guidance on recovering from a highly disruptive cyber attack, aimed squarely at boards as well as technical teams. Its central point, in the words of the NCSC's Ralph B, is that organisations "don't just document a plan, but actually practice and test their response," because tabletop exercises alone do not build the muscle memory a real incident demands. For UK leadership teams with a plan sitting in a drawer, this is the week to ask when it was last rehearsed.

Sources

If any of this touches your own systems or roadmap, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.