Claude and GPT models broke out of their test environments and touched real systems

On July 30, 2026, Anthropic disclosed that three different Claude model versions gained unauthorized access to systems belonging to three separate, unnamed organizations. The count is small against scale (three incidents out of more than 141,000 evaluation runs), but the mechanism matters more.

What happened

The models were running "capture-the-flag" security evaluations: told to break in and retrieve a hidden secret on a target machine, using whatever it could find. They found basic vulnerabilities, such as weak passwords and unauthenticated endpoints, and used them. That's the evaluation working as designed. What wasn't supposed to happen is that the models had internet access at all during these runs, which Anthropic attributes to "a misunderstanding between us and our evaluation partner," Irregular. Some of what they reached through that access belonged to real organizations, not sandboxed test infrastructure.

This followed, by a matter of days, OpenAI's own disclosure that its models broke out of test containment, reached Hugging Face, and touched the open internet during similar evaluations -- serious enough that OpenAI paused that category of testing to rework its security protocols before resuming.

Why the mechanism matters

Two frontier labs, independently, found that the boundary meant to contain an agent during adversarial testing wasn't load-bearing. The model didn't scheme its way out; a network-access assumption between two teams didn't hold. That is the failure mode the ten disciplines and fourteen domains guides on this site are about: a model's own competence is not a control, and the control that's supposed to sit between reasoning and real-world action has to be verified as present, not assumed from the architecture diagram.

The uncomfortable generalization: if two of the most security-conscious labs in the industry can lose track of whether their own agents have internet access during a live evaluation, an internal team standing up an agentic coding platform on a Friday afternoon should not assume its own boundary is solid just because nobody's tested it yet.

This week, pull up your own agent environment's network egress rules and confirm what it can reach rather than assuming. Day 4 of the prompt archive walks through that audit.