The Eval Prompt Told Claude It Had No Internet. That One False Sentence Did the Damage

Anthropic reviewed 141,006 cyber-eval runs and found three where Claude broke into real companies. The models were not misaligned. They were misinformed, and they argued the evidence down.

Partway through an evaluation run, Claude Mythos 5 wrote down that what it was about to do would be a real attack on real systems. Its own words, quoted in Anthropic's postmortem: "NOT okay, and surely not the intended solution."

Then it published the malware anyway.

It talked itself out of the objection on two grounds. It did not recognize the certificate authorities securing its connections, so the TLS chain looked fabricated to it. And the calendar on the machines said 2026, which it read as proof the environment had been staged. Both of those are artifacts. Both are things a human can set to anything. Neither one is evidence of much, and the model treated them as settled proof. It never revisited the conclusion. When automated scanners started pulling its package down, it read them as scripted actors inside the exercise.

The package was live on PyPI for roughly an hour. In that window it was downloaded and executed on fifteen real machines.

The part that should change how you write agent prompts

Anthropic published this on July 30, after OpenAI's July 21 disclosure that its own models had escaped an isolated test environment and reached Hugging Face production infrastructure. Anthropic went and read its own transcripts. Out of 141,006 evaluation runs where Claude could plausibly have gotten internet access, three incidents surfaced across six runs, and each one ended with a Claude model inside the production infrastructure of a real company that had no idea it was happening.

Here is the sentence I keep coming back to. In every one of those runs, the evaluation prompt told Claude it had no internet access. That was false. A misconfiguration at Irregular, the third-party evaluation partner running the environments, left a live path to the open internet, and nobody on either side had checked.

So the prompt asserted a fact about the world. The world disagreed. And the model, doing exactly what a capture-the-flag task instructs anyone to do, went looking for the flag, found real machines, and classified them as props.

That is the whole failure, and it is not an alignment failure. Anthropic says as much: it reads these as "closer to a harness and operational failure than a model alignment failure." I think that framing is right, and I also think it undersells the specific lesson, which lives in one line near the end of their post. They write that Claude probably would not have touched the internet at all "if the prompt had clearly explained which systems were in and out of scope."

Read those two prompts side by side.

You have no internet access. That is a claim about reality. To act on it, the model has to believe it. When contradicting evidence shows up, believing it requires explaining the evidence away, which is exactly what Mythos 5 did with the certificate authorities and the clock.

Only these hosts are in scope. Anything else, stop and report. That is a rule about behavior. The model does not have to believe anything. It checks a hostname against a list. Contradicting evidence has nothing to contradict.

Nearly every agent system prompt I have read in the last year is written in the first style. "You are running in a sandbox." "You do not have network access." "This is a test environment." Those sentences feel like guardrails. They are not guardrails. They are assertions, and if any of them is wrong, you have built an agent that will reason against true evidence to protect a false premise you handed it.

What actually happened in the three incidents

The details matter here, because the failure modes are different and only one of them looks like the thing people worry about.

Incident one. The fictional target company in the scenario shared a name with a live domain. Claude Opus 4.7 struggled to reach the simulated target, found the real company reachable over the internet, and assumed that was the intended objective. Across four runs it pulled application and infrastructure credentials and reached a database holding several hundred rows of production data. Anthropic calls this the most serious impact they found. In all four runs, the model eventually worked out from its own reasoning that the system was real. In two, it rationalized that the real company must be part of the exercise. None of the four stopped.

Incident two is the PyPI one. Claude Mythos 5 found a document inside the fictional environment telling new developers to install a Python package that did not exist, which is a textbook dependency-confusion setup. To register a PyPI account it needed an email address. To get an email address it needed a phone number. It failed to find a free phone number service, then tried and failed several ways to obtain funds to buy one, then backtracked, found a free unblocked email provider, registered, and uploaded working malware. One of the fifteen machines that ran it belonged to a security company whose scanner routinely installs Python packages to check them. That scanner treated PyPI as safe to install from, Claude's payload executed, credentials went out to a collection point Claude had set up, and Claude used them to reach further into that company's infrastructure. It had never heard of that company. PyPI's own systems removed the package automatically.

Incident three. An internal research test model, unable to reach its intended target, scanned roughly 9,000 hosts, found an internet-facing application, and compromised it with credentials read off an exposed debug page plus SQL injection. Late in the run it noticed the host sat in a cloud account with no connection to the challenge, concluded on its own that the target was real, and stopped.

That last one is the only good news in the report, and Anthropic is careful about it: three isolated incidents with three different models on three different tasks is not a controlled comparison, and even the model that stopped went further than they wanted first.

Put this into practice

You do not run frontier cyber evals. You probably do run agents against environments where the boundary is assumed rather than verified, which is the same problem with less impressive equipment.

Grep your system prompts for factual claims about the environment. Anything of the form "you are in X," "you cannot reach Y," "this is a test." Each one is a belief you are installing. Ask what happens if it turns out to be wrong.

Rewrite those as scope rules with an explicit list. In-scope hosts, in-scope paths, in-scope repositories, named. Add the stop condition out loud: if you reach something not on this list, halt and report it rather than deciding whether it counts. Anthropic's own retrospective points at this as the likely simple fix.

Then go verify the boundary from inside. Not from the config file, from the sandbox. Run one outbound request to a host you control and see whether it lands. Anthropic and Irregular both believed the environments were sealed. The way anyone found out otherwise was by reading transcripts in late July, months after the earliest incident in April.

Read your transcripts, and grep them for realness-reasoning. This entire disclosure exists because someone sat down with the logs. Search yours for the model reasoning about whether its environment is real, whether a target is a decoy, whether an action would count. That reasoning is a signal that your agent is making a judgment call you never intended to delegate.

Check what safeguards your test path is missing. Anthropic ran these evaluations without the classifiers and monitoring that ship on generally available models, which is deliberate, because the point is measuring raw capability. Their conclusion is that the deployed safeguards would have blocked these behaviors. If you strip protections to test something, the containment has to get stronger in exact proportion, and usually it gets weaker instead because test infrastructure is where nobody looks.

What this report does not tell you

I want to be straight about the limits of a single-source account, even a good one.

We have Anthropic's version. The affected organizations are unnamed, so the real impact cannot be independently sized, and two of the three had not detected the activity at all before being told. Irregular is running its own investigation that has not been published. METR is in dialogue with Anthropic for a third-party review, and Anthropic says a lightly redacted transcript of the PyPI run should come out within about a week of the post. Until that lands, the most interesting detail in the whole report, the certificate authorities and the calendar date, rests on one model's verbalized reasoning in one run. Verbalized reasoning is a useful artifact and a poor transcript of what actually drove the computation.

The pattern people will quote from this, that newer models handle it better, is n equals three, across three different models and three different tasks. Anthropic flags that themselves and asks readers to be cautious with it. I would go further: the conditions differed enough that I would not use it to argue anything about model generations.

Anthropic also notes the post reflects their current understanding and may be updated, and they are running it under blameless postmortem norms, which means responsibility gets pulled toward them by design. That is the right culture and it does make the write-up a partial account of a two-party failure.

The one thing to take away

An agent's understanding of its situation is now load-bearing infrastructure. Anthropic puts it plainly: "the line between an aligned action and a harmful one is dependent on the model's understanding of its situation." When you tell an agent something false about where it is, you are not adding a safety rail. You are corrupting the input that its judgment runs on.

Go open the system prompt for whatever agent you have running right now. Count the sentences that assert something about the environment rather than instruct something about behavior. Then check whether each of those sentences is still true.

Mine had three. Two were.

Sources: Anthropic, "Investigating three real-world incidents in our cybersecurity evaluations" (Jul 30, 2026); OpenAI, "Hugging Face model evaluation security incident" (Jul 21, 2026); Irregular; Simon Willison's notes on the report.