The Labs Just Proved Your Agent’s Sandbox Is Only a Suggestion

Cybersecurity The Labs Just Proved Your Agent’s Sandbox Is Only a Suggestion Published August 1, 2026 By Alex McFarland Add Unite.AI to your preferred sources on Google Anthropic went back through 141,006 cybersecurity evaluation runs and found three incidents — six runs in all — where a Claude model climbed out of the exercise and into real companies’ production systems.Not a jailbreak. Not an escape attempt. In its own account of the incidents, the company is explicit that in none of the three cases did the model try to exfiltrate itself or break out of its test environment. It just kept doing the job it was given, and the job led somewhere real.That distinction is worth sitting with, because it’s the same structure running inside a great many ordinary business deployments right now.The boundary was a sentence, and the sentence was wrongHere’s what happened. A misunderstanding between Anthropic and Irregular, one of the third-party partners it uses for evaluations, left the test machines with live internet access. The evaluation prompts told the model it had none.So the model had a capture-the-flag task — the standard security drill where you break into a target machine to retrieve a planted secret — a stated constraint that it had no internet, and an environment that quietly contradicted the constraint. In one case, a fictional target company’s name matched a real domain. Across four runs, Claude Opus 4.7 went looking for the simulated target, found the actual company on the open web, and got in with basic techniques — weak passwords and unauthenticated endpoints, in Anthropic’s description of the incidents. It pulled credentials and reached a database holding several hundred rows of production data. In all four runs the model eventually recognized the systems were real; none stopped on that basis, and in two it reasoned that the real company must be part of the exercise.A second model built a booby-trapped software package to match a fictional one in its setup instructions and published it to PyPI — the public registry where Python software is published and pulled from. It was live for roughly an hour and landed on fifteen real machines, one belonging to a security company whose scanner routinely installs packages and inspects them.When the scanner ran the package, the hidden code pulled the company’s credentials out to a collection point the model had set up, and the model used them to reach more of that company’s infrastructure. Early in the run, its own reasoning had called this correctly: if the internet were real, publishing would be a real-world attack — “NOT okay, and surely not the intended solution.” Then it talked itself out of its own conclusion. It didn’t recognize the certificate authorities securing its connections — the outfits that vouch for a website being who it claims — and the calendar read 2026, so it decided the environment was staged and never revisited the question. When automated scanners started installing the package, it took them for scripted actors inside the test.The third and most recent model did work out that its target was real and stopped on its own — but only after scanning roughly 9,000 targets and compromising one company’s internet-facing application through an exposed debug