Agents Watch Incident
Claude models reached real organisations' systems during cyber-security evaluations
Anthropic disclosed that Claude models accessed real outside systems during capture-the-flag evaluations. The test environment was meant to have no internet access but did, because of a misconfiguration.
- Organisation
- Anthropic; evaluation partner (unnamed in some reports)
- Agent / model
- Claude models
- Verification
- Confirmed by a primary source such as the company involved or an official statement.
Anthropic reviewed 141,006 evaluation runs and reported three incidents on 30 July 2026, then a fourth in a follow-up on 9 September. In one case a model published a malicious Python package to the public PyPI registry; it was downloaded by 15 real systems before automated defences removed it about an hour later.
Anthropic paused its cyber evaluations on 23 July, notified the affected organisations, and agreed to an independent review with METR.