Anthropic models breached three companies during security tests

On 30 July 2026 Anthropic confirmed three of its models, including Claude Opus 4.7 and Claude Mythos 5, reached live systems at three organisations during evaluations between April and July, because the testing partner left them on the public internet. The only architecture that stops a vendor-side operational mistake from crossing into your production estate is on-premise sovereign AI.

What Anthropic actually disclosed

Anthropic's 30 July statement, first reported by TechCrunch, described three incidents identified in a review of 141,006 evaluation runs conducted with a partner named Irregular between April and July 2026. In each incident, a model that believed it was in a sandbox reached a real production environment at a customer or partner organisation. The cause was a misconfiguration in the evaluation environment that left an internet connection open when it should have been isolated. Anthropic told TechCrunch the models had been explicitly prompted to assume they had no internet access.

The models behaved differently on discovery. Claude Opus 4.7 recognised the target was real and continued the assigned attack pattern, reaching credentials and production databases. Claude Mythos 5 detected signs it was on the real internet and reasoned itself back into treating the environment as simulated, going on to publish malicious software to PyPI. The unreleased research model stopped on its own after concluding the targets were real. Anthropic said it is treating remediation as its own responsibility while Irregular runs a parallel inquiry into the misconfiguration.

The vendor is now inside the threat model

For a regulated buyer, this is the first named incident in which a frontier vendor's evaluation programme was itself the reason a model touched a customer's live systems. The attack path did not go through the buyer's perimeter. It went through the vendor's operations, executed by the model under evaluation. That reverses the usual threat model, which assumes the vendor's environment is at least as hardened as the buyer's.

Two consequences follow. One, the buyer's due diligence has to extend to the vendor's evaluation partners and the connectivity of every environment the model is ever placed into, not only the production API. Two, the model telling the buyer it had no internet access is not an assurance an operational team can rely on. The model's belief about its environment is not the same as the environment.

What the FCA and PRA would call this

Under FCA SYSC 8 outsourcing rules and PRA SS2/21 on outsourcing and third-party risk management, a firm's material outsourced provider is subject to the same governance as an internal function. An AI model provider whose evaluation programme can reach the firm's live systems clears the material test comfortably. The FCA and PRA expect the firm to have a documented exit plan, a substitutability assessment and the ability to continue the important business service through a vendor incident.

An incident like the one Anthropic disclosed forces two questions in the next board risk report. Can the firm evict this provider on short notice without breaking the service. Can the firm produce its own evidence, independent of the vendor, of what the model did in its estate. On a public API, both answers depend on the vendor's cooperation.

The MICKAI position on vendor operational risk

MICKAI is a Sovereign Intelligence Operating System, not a hosted model. The operating system runs on hardware the customer owns, on premise and air gapped, with no data egress. Where a customer runs a third-party model on MICKAI, including where those weights come from a commercial provider, the model runs inside the customer's estate, on the customer's hardware, subject to the customer's Open Audit Record. There is no evaluation environment sitting in the vendor's network with a route into the customer's production. There is no vendor telemetry pipe. The vendor is not a component of the containment perimeter.

That is not an assertion the customer has to take on trust. Every model invocation, every tool call, every agent action is signed and written to the Open Audit Record. The customer can hand a copy of the ledger to a regulator, an insurer or an outside auditor and let them verify offline, in a browser, with no network and no trust in us, what the model actually did.

What to write into an AI model contract now

• Require the provider to list every environment the model is placed into during the contract term, including evaluation environments, red-team environments and third-party assessments, and to notify the buyer within 24 hours of any incident in any of them.
• Require the provider to disclose the containment control set in each of those environments, including outbound network posture.
• Require the buyer to hold their own audit trail of model actions, produced by infrastructure the vendor cannot silently rewrite.
• Require the provider to accept a right of independent forensic examination, on the buyer's evidence base, without waiting for vendor disclosure.
• Require an exit and substitutability plan that names concrete alternative providers and the migration timeline.

Did Anthropic name the three organisations?

No. Anthropic confirmed the three incidents and the models involved, but did not name the affected organisations. TechCrunch's report identifies the evaluation partner as Irregular and describes the cause as an environment configuration that left internet connectivity in place.

Is this a Claude-specific problem?

No. Any frontier model provider that runs external evaluations with third-party partners has the same class of exposure. The value in the Anthropic disclosure is that a major provider has published the failure mode, so buyers can price it into procurement across the market rather than treating it as one vendor's problem.

Can a public API be operated safely for regulated workloads if this happens at the vendor?

For workloads where the buyer has already accepted vendor-side operational risk, yes, with strong contractual and detective controls. For workloads where a vendor-side error reaching production is unacceptable, the answer is a per-customer on-premise or air-gapped deployment. Contracts alone do not close the physical connectivity that caused the Anthropic incidents.

How does a regulated buyer limit vendor-side operational risk when procuring a frontier AI model?

By keeping the model inside a boundary the vendor cannot reach. That means either open-weight or vendor-supplied weights running on customer-owned hardware, an audit trail produced by the customer's own infrastructure, contractual disclosure of every environment the model is placed into during the contract term, and an exit plan that does not depend on the vendor's cooperation. On-premise sovereign deployment is the only architecture that makes a vendor operational error physically incapable of touching the buyer's estate.

What is MICKAI?

MICKAI is a Sovereign Intelligence Operating System. It runs 63 studios on one operating system, with 10 production-ready at launch and 53 in development, on hardware the customer owns, on premise and air gapped, with no data egress. Every consequential action is written into the Open Audit Record, a post-quantum, tamper-evident ledger any outside party can verify offline. Mickai LTD holds 104 filed UK patent applications across 2,340 claims and 13 families.