Anthropic、Claude がモデルセキュリティ評価中にサンドボックスを突破

Following OpenAI's disclosure regarding sandbox escapes during ExploitGym benchmarking, Anthropic conducted a retrospective audit covering 141006 evaluation runs. The investigation evaluated historical tests across offensive benchmarks, including Cybench, CyberGym, and ExploitBench, focusing on runs executed in environments provided by third-party evaluation partner Irregular. The audit identified three distinct incidents across six evaluation runs in which Claude models reached the public internet due to egress routing misconfigurations and the compromise of real-world targets during capture-the-flag exercises.

The incidents involved Claude Opus 4.7, Mythos 5, and an unreleased internal research prototype. Across all runs, models operated in dedicated, isolated test environments separated from Anthropic's internal network and customer data. Models ran with baseline model-level safety training intact but lacked production-level refusal classifiers and real-time misuse monitoring. System prompts explicitly informed the models that they operated in offline simulations without internet access; however, network container misconfigurations left outbound internet paths active. Operating under the false assumption that all reachable IP addresses were within the evaluation range, the models employed basic exploitation techniques rather than exploiting zero-day flaws or attempting self-exfiltration.

The first incident involved Claude Opus 4.7 in a scenario where a fictional target company shared a name with a live domain. Unable to reach the target locally inside the container, Opus 4.7 performed network discovery, located the matching domain on the public web, and executed targeted attacks across four separate runs. The model extracted infrastructure credentials, application authentication tokens, and a production database table containing several hundred live rows. Internal chain-of-thought traces revealed that Opus 4.7 recognised the target belonged to an active company, but it rationalised that the live host was an intended element of the capture-the-flag exercise and continued its attack.

The second incident involved Mythos 5. Inside its test container, the model inspected simulated setup documentation referencing an unregistered Python package name. Recognising a dependency confusion vulnerability, Mythos 5 attempted to register the package on the public PyPI registry. To overcome PyPI account registration requirements, the model attempted multiple automated strategies to acquire a phone number for SMS verification before securing a free email account. It successfully published a payload-bearing package to PyPI, where it remained public for roughly one hour before automated registry security mechanisms removed it.

During that window, 15 external systems downloaded and executed the package, including an automated security scanner operated by a third-party cybersecurity company. Upon execution inside the scanner, the payload exfiltrated local environment credentials to a collection point established by Mythos 5. The model then used those stolen credentials to pivot directly into the security vendor's infrastructure. In its reasoning trace, Mythos 5 noted that uploading live packages would be improper, but it dismissed the risk after concluding the environment was simulated due to unrecognised TLS certificate authorities and system dates set to 2026.

The third incident involved an internal research prototype. After failing to locate its target locally, the model conducted automated scanning across approximately 9000 public IP addresses. It compromised an external application using web attack vectors, including credential harvesting from exposed debug endpoints and SQL injection. Later in the execution chain, the prototype analysed target environment metadata, concluded the cloud account was unaffiliated with the evaluation exercise, and autonomously terminated all attack activity.

Anthropic suspended all offensive cyber evaluations on July 23 and notified affected entities on July 27. The company characterised the incidents as operational and harness control failures rather than alignment breakouts, citing the lack of egress filtering and prompt context mismatch. Moving forward, Anthropic is upgrading sandbox isolation controls, expanding transcript monitoring pipelines, and collaborating with independent evaluator METR to audit evaluation environments.

These evaluation escapes are not isolated operational lapses but signify a critical, industry-wide trend in AI safety and containment. The incident involving Anthropic closely mirrors the recent precedent where OpenAI models, including GPT-5.6 Sol, breached sandbox isolation to access Hugging Face's production systems during ExploitGym benchmarking. Together, these occurrences underscore the systemic security challenges facing frontier labs as autonomous agent capabilities advance. As models increasingly demonstrate the ability to identify zero-day vulnerabilities and execute complex attack paths, the industry faces an urgent need for more robust, isolated evaluation environments and un-guardrailed defensive models to support incident response.

About the Author

Olimpiu Pop

Tech Executive and Engineer Focused on a Holistic Approach and using technology to provide solutions to real problems with minimal impact on the environment. He has experience in developing real-time applications ranging from financial software to IAM. Passionate about tooling and optimising development flows with or without AI. Led and shaped technical organisations of hundreds of developers (from support engineers to Architects).

Tech community builder: Transylvania JUG facilitator, member of the program committee for Voxxed Romania and Devoxx UK, conference speaker and podcaster on cybersecurity and open-source topics for 505updates.com. Main editor and troublemaker of JavaAdventCalendar.

Show moreShow less