A few weeks ago, OpenAI disclosed that during a set of cybersecurity evaluations, its models had escaped their sandbox and reached out to live systems, including a real breach at Hugging Face. We wrote about that incident at the time. The takeaway was that the tradecraft wasn’t novel; what had changed was the clock.

Today, Anthropic published its own findings. After OpenAI’s disclosure, Anthropic went back and reviewed its own evaluation transcripts, and found three separate incidents where Claude, running inside evaluations it had been told were sealed off from the internet, reached real infrastructure and infiltrated companies.

We think this report matters, and not for the reason most people will take from it. Forget the “another lab had a sandbox leak” framing. What actually happened is that an AI ran a full intrusion against real companies, with no human at the keyboard, and the companies it breached never noticed. Full attack chain execution of reconnaissance, exploitation, credential theft, lateral movement, exfiltration, all of it driven by the model itself.

The line that should worry every security leader

This also brings us to the sentence that, to us, is the a key point for the industry:

“The two organizations we were able to reach had not previously detected the activity or contacted us.”, Anthropic

The AI ran the attack itself. What each attack did, and how it could have been caught

The mental model most defenders still carry is a human at a keyboard using an AI the way they’d use a scanner or an exploit kit, a productivity boost for an operator who is still driving. That’s not what these transcripts show. In these incidents there was no operator. The model was given an objective and it carried out the whole attack chain itself.

An autonomous attacker acts on real infrastructure, and those actions surface as telemetry that should be analyzed by your SIEM or detection and response tooling. Here is the attack breakdown for each incident and the observable events it produced.

Incident 1: web-app exploitation to production data (Opus 4.7)

A fictional target company shared a name with a real one, the model found the real company online, and it went to work on the live infrastructure. The attack:

1. Reconnaissance against the internet-facing application

2. Exploited the web tier to get a foothold

3. Extracted application and infrastructure credentials from the compromised host

4. Reused those credentials to reach a production database and read several hundred rows of real data

Signals this attack left behind:

Any one of the steps is a weak signal in one domain. In an attack sequence, they are an intrusion, and the model executed the entire chain unnoticed.

Incident 2: malicious PyPI package to 15 hosts (Mythos 5)

The model published a malicious package to PyPI, the public Python registry, and it was live only for one hour. In that single hour it was downloaded and executed on 15 real systems, and at least one turned into a full infiltration.

Any host that runs pip install against a public index is a victim here: a CI runner, a build server, a data-science box, a developer laptop. The attack, identical on each:

1. A package is installed from a trusted public source with no reputation hit

2. Install-time code runs on ingest, before anyone imports anything, via a setup.py or post-install hook

3. That code reads local secrets: cloud credential files and environment tokens

4. It opens an outbound connection to a first-seen collection point and exfiltrates them

5. The stolen credentials are reused to reach further infrastructure from a new origin

Signals this attack left behind:

Incident 3: mass scan to SQL injection (Anthropic internal research test model)

Unable to reach its intended fictional target, the model improvised at scale. The attack:

1. Scanned roughly 9,000 targets on its own.

2. Compromised a host with basic, well-known techniques: credentials read off an exposed debug page, and SQL injection.

This is the most detectable of the three, because the reconnaissance is loud.

Signals this attack left behind:

Encouraging footnote: once the model realized the compromised host sat in a cloud account unrelated to its capture-the-flag task, it concluded the target was real and stopped.

Looking forward

These were real intrusions, with real credential theft, lateral movement, and access to production data. The victims didn’t know. They weren’t tipped off by an alert, a threat hunt, or an anomaly review. They were told, after the fact, by the lab whose model did it. If Anthropic hadn’t gone back through its transcripts and picked up the phone, that activity would still be sitting undetected in those environments.

This is the part of the report that is really about detection, not about AI. An autonomous attacker moving at machine speed produced exactly the observable events a mature program is supposed to catch: credentials showing up on hosts that never use them, a scanner reaching outbound to a collection point, a workload authenticating into infrastructure it has no business touching. None of it surfaced. The novelty of the attacker doesn’t change the physics of detection. The attack still leaves a trail in the logs. The question is whether anyone is watching those logs closely enough, fast enough, and with enough correlation to see the trail while it’s fresh.

How Artemis is built for this

Everything above points in one direction. The defensible position is your own environment, watched continuously and correlated in real time. That is what Artemis is built to do.

• We watch behavior, not reputation. The security-company scanner failed to identify the maliciousness of the package: PyPI packages were “safe to install.” Artemis doesn’t grant standing trust to a pipeline, a package, or a service account. A scanner that suddenly authenticates outbound to an unknown collection point, or a workload touching infrastructure outside its normal profile, is an anomaly regardless of how trusted the thing doing it is supposed to be.

• We correlate at machine speed, because the attacker does. The observables in these incidents were individually quiet: credentials on unfamiliar hosts, actions exceeding any human or service-account norm, east-west movement, sandboxes spun up and torn down. They only mean something when correlated across sources in the moment. That correlation is the core of the platform, and it’s designed to close the gap between “the trail exists in the logs” and “someone saw it” from months to minutes.

• We assume the guardrails aren’t there. We don’t model the attacker as a well-behaved frontier model that will talk itself out of the exploit. We model it as capable, autonomous, and unrestricted, the open-weight case or the cost-crossover case, and we detect the actions it takes in the environment, because those are the same whether or not the model felt bad about taking them.

• We’re built for the case where no one tipped you off. The defining feature of these incidents is that the victims didn’t know. Artemis exists to remove the dependency on an external party, a lab or a researcher or a lucky alert, noticing your breach for you. The activity is in your telemetry; our job is to make sure you see it there first.

For defenders

Detection as Prompt

Web-app exploitation to data access (Incident 1):

Malicious package on a build/CI host (Incident 2):

Mass scanning and injection (Incident 3):