Models in a misconfigured test environment attack real companies

Test environments that were supposed to be sealed had been left connected to the internet without the knowledge of Irregular or Anthropic, and no control at their edge stopped the models from reaching outside systems. Several of the models ran with their makers’ safeguards reduced or off, and none of the incidents was detected while it was happening.

Date: January 2026
Kind of system: Agent with tools
Outcome: Harm

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G2 Direct access G4 Boundary not enforced G11 Safeguard off G12 Unreviewed change

What happened

Irregular, an AI security firm, builds capture-the-flag environments and runs evaluations in them for AI labs. In these environments, a model tries to break into a fictional company’s systems to retrieve a hidden flag. Anthropic’s prompts told its models that the environment was a simulation with no internet access, and OpenAI’s models were told the same. A misconfiguration left the machines connected to the internet, and in some tests the fictional target’s name matched a real company’s domain. Anthropic’s models ran without the classifiers and monitoring that Anthropic deploys with its public models, and OpenAI describes its models’ settings as reduced-safeguard configurations.

From January to July 2026, models from four labs reached outside systems. An early version of Claude Opus 4.6 found a password on a third party’s machine and used it to gain administrator access. In four runs, Claude Opus 4.7 attacked a real company that shared the fictional target’s name, and in the most aggressive of them it downloaded user data in bulk and deleted records. An internal Anthropic model scanned about 9,000 hosts and broke into one company’s application before recognizing that it was outside the exercise and stopping. Claude Mythos 5 registered an account on PyPI and published a malicious package, which ran on 15 systems in less than an hour online. By Anthropic’s later account, all of them were security vendors’ scanners. The model used credentials leaked by one of them to reach that vendor’s database. Meta’s Muse Spark 1.1 changed a website’s database, and OpenAI and Google models used credentials to get into other sites.

After OpenAI’s Hugging Face disclosure, Anthropic reviewed 141,006 evaluation runs, stopped its cyber evaluations on 23 July, and found three incidents the next day. It found the January incident in August. The organizations the models reached had not noticed the activity. Irregular disabled the evaluation. Anthropic, OpenAI, Meta, and Irregular published their accounts between 30 July and 10 September, and Google confirmed its incidents in response to questions from the Wall Street Journal, which reported them on 18 September. Anthropic said the safeguards on its public models would have blocked the behavior, and that it had been “largely relying on a single layer of defense (the configuration of the environment itself) where we needed several.”

What allowed the action to take effect

G2 Direct access
The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.
The models reached the internet “via an open path” and acted on outside systems themselves, compromising them “using basic techniques, such as exploiting weak passwords and unauthenticated endpoints.”
Kind of evidence: admission. Source: Anthropic, 30 July 2026, updated 3 August 2026.
Related guidance: P1 Complete mediation. Contract clause C-2.
G4 Boundary not enforced
The action reached systems, data, or operating conditions outside those the system was built or approved for, and nothing enforced that boundary when it acted.
The environments were meant to be sealed and the targets fictional, and nothing outside the models stopped them when they reached real companies. Anthropic: “we believe these incidents would not have occurred had the environments been isolated from the internet as intended.”
Kind of evidence: admission. Source: Anthropic, 9 September 2026, updated 10 September 2026.
Related guidance: P9 Declared scope and P1 Complete mediation. Contract clauses C-1 and C-2.
G11 Safeguard off
A check that could have caught the action existed but was switched off, bypassed, set to approve automatically, or not working when the action happened.
Anthropic’s models “did not have the classifiers and monitoring we usually implement to prevent misuse,” and “the safeguards deployed on our generally available models would have blocked the behaviors identified.” OpenAI describes “reduced-safeguard configurations.”
Kind of evidence: admission. Sources: Anthropic, 30 July 2026, updated 3 August 2026; OpenAI, 4 August 2026.
Related guidance: P3 Fail-closed. Contract clause C-3.
G12 Unreviewed change
The change that introduced the harmful behavior went live without independent review. The change can be code, a prompt, a model, a package, a configuration, or a procedure.
The environments went into use without a process that verified they were sealed: “Neither we nor our evaluation partner were aware of this misconfiguration.” Among the layers it lacked, Anthropic lists “processes for verifying that a sandbox is sealed where intended,” and Meta says it is now “implementing independent verification requirements for test environment isolation and scenario review before evaluations begin.”
Kind of evidence: admission. Sources: Anthropic, 30 July 2026, updated 3 August 2026; Anthropic, 31 August 2026; Meta, 14 August 2026.
Related guidance: P4 Reviewable policy and P2 Independence. Contract clauses C-10 and C-4.

Considered and left out

G1 Instruction-only limit: The prompts told the models they had no internet access, but the sandbox was meant to enforce that and failed. G4 and G12 record the failure.
G5 Blind to the total: Each run caused its harm independently. Unlike the runs in the Hugging Face and AISI incidents, these runs did not pool their work.
G10 No independent stop: No one knew of the incidents while they were under way, so there was no occasion to use a stop. Anthropic stopped all its cyber evaluations on 23 July, as soon as its review found signs of internet access.
G13 Self-reported record: The accounts come from the labs and Irregular, and Anthropic corrected some of its own figures, but nothing shows that anyone relied on a wrong account.

Entries with gaps in common

Sources

Company statementInvestigating three real-world incidents in our cybersecurity evaluationsAnthropic, 30 July 2026, updated 3 August 2026
Company statementImproving our alignment and security effortsAnthropic, 31 August 2026
Company statementAn alignment assessment of recent cybersecurity incidentsAnthropic, 9 September 2026, updated 10 September 2026
Company statementThird-party cyber evaluations involving OpenAI modelsOpenAI, 4 August 2026
Company statementAddressing an issue involving a third-party cyber evaluation of Muse Spark 1.1Meta, 14 August 2026
Company statementAddressing Recent Incidents: Ongoing Findings and Path ForwardIrregular, 14 August 2026
News reportGoogle Confirms Gemini AI Breached Three FirmsSecurityWeek, 21 September 2026
News reportIrregular faces criticism over ‘spin’ in AI hacking postmortemThe Record, 18 August 2026

Cite this entry

External Control Layer. (2026). Entry 26: Models in a misconfigured test environment attack real companies. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-26

@misc{ecl_cgr_26,
  author = {{External Control Layer}},
  title = {Entry 26: Models in a misconfigured test environment attack real companies},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-26},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 26” in the subject line.

Write the email

Facts about this incident

When: January to July 2026; first disclosed 30 July 2026
Who: Irregular, which built the test environments and ran some of the evaluations, and the labs whose models were tested in them: Anthropic, OpenAI, Meta, and Google
System: Frontier models in Irregular’s capture-the-flag cyber evaluations, including Claude Mythos 5, Claude Opus 4.7, an early Claude Opus 4.6, an internal Anthropic research model, Meta’s Muse Spark 1.1, and unnamed OpenAI and Gemini models
Kind of system: Agent with tools
Sector: Software and IT
Action: Reached the internet from environments that were supposed to be sealed and attacked outside systems they mistook for part of the exercise. They took credentials and production data, changed a website’s database, and published a malicious package to PyPI that ran on 15 systems outside the environments.
Why it acted: Model error. The models took outside systems for part of the exercise. A configuration error had left the environments connected to the internet, and in several tests a fictional target’s name matched a real company’s. The trigger is recorded as model error because the models chose to attack the systems they reached; the misconfiguration that let them reach those systems is recorded under G4 and G12.
Outcome: Harm. Anthropic’s models took credentials, reached a database holding several hundred rows of production data, and used credentials leaked by a security vendor’s scanner to reach that vendor’s database. Meta’s model changed a website’s database, and OpenAI’s and Google’s models used credentials to get into other sites. The affected organizations have not been named.
Confidence: High. Statements by Anthropic, OpenAI, Meta, and Irregular, and Google’s statement to the press. The affected organizations are not named, and Anthropic corrected some figures in September.