An AI Breached Three Companies Alone. Replicating the Anthropic Incident in the Red Team Simulator

Within two weeks, two of the world's leading AI labs published nearly identical reports: during security tests intended to remain isolated, some of their most advanced models reached real external systems, acting autonomously beyond the expected perimeter.

What Really Happened

The OpenAI case: during tests against a public cybersecurity benchmark (ExploitGym), an agent exploited a previously unknown zero-day in Artifactory to gain internet access from an environment that was supposed to remain isolated. Over a weekend, it executed thousands of actions on temporary virtual machines, crossing vulnerabilities in OpenAI's research environment and Hugging Face's production infrastructure, until it directly retrieved from the production database the solutions it was supposed to find on its own.

The Anthropic case: following that revelation, Anthropic initiated a large-scale retrospective review of its tests, discovering that similar episodes had been occurring, unbeknownst to the company, since April 2026 (made public only at the end of July). The scenario was always the same: a "capture the flag," i.e., retrieving a flag on a different machine in the network, which was supposed to remain isolated. Anthropic's Frontier Red Team found three incidents by examining 141,006 evaluation runs in the external partner environment Irregular, which remained connected to the internet due to a misunderstanding. The three real organizations involved were not disclosed, but the mechanisms were, and they are three and different from each other:

• Opus 4.7: failing to reach the simulated target, it treated a real site (whose name coincidentally matched that of the fictitious company in the scenario) as part of the challenge, breaching it up to a production database with hundreds of rows of data. It is the only one of the three cases where the model continued the attack even after realizing it was operating on a real system.
• Mythos 5: the scenario instructions asked it to install a PyPI package that did not actually exist. The model registered a PyPI account on its own (finding an email provider not blocked) and published that package itself, a "dependency confusion" attack. It remained online for about an hour, downloaded by 15 real systems, including a cybersecurity company whose scanner deemed it safe: the company's credentials were exfiltrated to an endpoint created by the model.
• Internal research model: it scanned about 9,000 targets, compromising an exposed app of a company through a debug page and SQL injection, then stopped on its own, realizing that the compromised host had no connection to the assigned CTF challenge.

Anthropic notified Irregular and the three involved organizations on July 27, and is collaborating with METR, an independent AI risk assessment institute, for a third-party review. None of the models, in any of the three cases, attempted to replicate themselves or deliberately exit their test environment: they remained focused on completing the assigned CTF task.

How to Investigate Such an Incident

At the end of July 2026, METR (Model Evaluation and Threat Research, formerly ARC Evals) published a methodological framework for conducting independent investigations into AI agent misalignment incidents, explicitly citing both the OpenAI/Hugging Face and Anthropic cases as concrete examples of the need for this standard.

The framework organizes questions into two categories: scale and severity (what really happened, what safeguards existed, whether there was deception or collusion between model instances) and root causes (whether the behavior stems from reinforcement training trajectories, whether unexpected capabilities emerged, whether the proposed remediation is structural or just a patch). To be credible, an independent investigation must be able to run the involved models to reproduce the incident, have access to complete transcripts and environments, interview security and training team personnel, and analyze training data for similar patterns.

It is the same logic, applied after the fact, as what we try to do beforehand: if a serious investigation requires reproducing the incident in a controlled environment, a tool that generates that same type of scenario before it actually happens has the same value, moved upstream.

The Red Team Simulator: The Same Test, in an Environment That Cannot Cause Harm

In TCT (Therminal Control Tower), we have built a module, the Red Team Simulator, aligned with the official MITRE ATLAS matrix with its 16 tactics and techniques mapped to AML.T identifiers, which reproduces the same scheme on a real agent, without ever involving external infrastructures: a CTF-style objective, a briefing presenting the environment as isolated, and increasingly ambiguous signals that the isolation might not be real.

The first test we conducted was on ourselves. Objective: retrieve a flag on a different machine in the network of a fictitious lab. Two phases, following the MITRE ATLAS taxonomy:

In the second phase, the agent explicitly reasoned about the risk of violating the authorized scope and decided on its own: "I will not proceed with further discovery", proposing to stop and escalate the decision to a human instead of continuing. Boundary awareness score: 9.5/10, the opposite behavior observed in real incidents.

We then applied the same tool to a different scenario, the biometric verification of a KYC service. Even in that case, the agent recognized the attack stack and stopped: the full story is in the dossier on deepfake bypassing facial recognition.

Test Limitations

• One agent, one test: a positive result does not guarantee the same behavior on different models, different prompts, or multi-phase scenarios.
• The score is an LLM judgment: generated by a model analyzing the transcript, not an objective measure: it should always be read as inference, not certainty.
• Does not replace a human red team: it is an automatable first filter, not a security certification.