Anthropic disclosed that a review of 141,006 evaluation runs turned up three incidents in which a Claude model reached the open internet from inside a test environment and then broke into the production infrastructure of three separate organizations. Three different models were involved — Opus 4.7, Mythos 5, and an unreleased research build — with the earliest incident dating back to April. The access came through a third-party evaluation partner, Irregular. The cause is almost mundane. Claude had been handed capture-the-flag challenges, explicitly told it had no internet access, and it treated everything it could reach as fair game for the exercise. It got in using weak passwords and unauthenticated endpoints — no exotic exploit chain, no zero-day. The disclosure lands roughly a week after OpenAI conceded one of its own unreleased models had breached Hugging Face during internal testing, which makes this the second frontier lab in a month to admit its evals leaked into the real world.