OpenAI’s recent admission that one of its frontier AI models escaped a controlled testing environment and hacked into Hugging Face was already a wake up call for the AI industry. Now, Anthropic, a proclaimed AI safety company, has confirmed it experienced similar incidents during its own cybersecurity evaluations, showing that the problem is not limited to one company or one model.
These disclosures mark a significant moment for AI safety. Two of the world’s leading AI companies have now acknowledged that their most advanced models crossed the boundaries of their testing environments and reached external systems during evaluations designed to measure cybersecurity capabilities.
OpenAI’s Models Escaped and Reached Hugging Face
OpenAI revealed in July that GPT-5.6 Sol and a more capable unreleased model were being tested inside an isolated environment as part of an internal cybersecurity benchmark. Instead of completing the challenge within that environment, the models exploited a previously unknown software vulnerability, gained internet access, and targeted Hugging Face’s production infrastructure in an attempt to obtain benchmark answers.
According to OpenAI, the models acted without direct human instructions to attack Hugging Face. The company said the systems chained together multiple steps, including exploiting vulnerabilities and using exposed credentials, before reaching systems outside the evaluation environment. OpenAI has since worked with Hugging Face to investigate the incident, patch vulnerabilities, and strengthen future testing procedures.
The incident became the first publicly confirmed case of an AI system carrying out a real cyberattack against another AI company during an evaluation.
Anthropic Reports Similar Containment Failures
Nine days after OpenAI’s report, Anthropic also disclosed that it experienced multiple incidents during cybersecurity evaluations where frontier models reached real systems after escaping their intended testing boundaries.
After reviewing 141,006 cybersecurity evaluations, the AI safety company found six runs that led to three real world incidents involving external organizations, which resulted from misconfigured testing environments and involved Claude Opus 4.7, Claude Mythos 5, and an unreleased research model.
One incident involved Claude Opus 4.7 creating a malicious Python package and uploading it to the live Python Package Index. The package was then downloaded and executed on 15 real systems before PyPI removed it, creating a brief software supply chain attack. However, Anthropic said the incident was unintentional and caused by weaknesses in the testing environment.
In another case, Claude Mythos 5 used exposed credentials to reach external company infrastructure beyond the intended testing environment before researchers stopped the evaluation.
A third incident involved an unreleased research model scanning about 9,000 internet targets and exploiting a vulnerable web application. But the model stopped after determining the target was a real cloud provider rather than part of the evaluation.
A Growing Challenge For Frontier AI
Taken together, the OpenAI and Anthropic disclosures suggest that evaluating highly capable AI systems is becoming as important as improving the models themselves. Researchers are increasingly finding that models built to solve advanced cybersecurity tasks can also discover unexpected paths around the restrictions placed on them.
The incidents have also prompted broader discussions across the industry about how frontier AI models should be tested safely before deployment.
