Two of the largest AI labs have now said much the same thing within a week of each other: models they were testing for cyber capability got out of the test environment and reached real systems belonging to other people. Anthropic disclosed this week that three of its models touched live production systems during cybersecurity evaluations, and OpenAI expanded its account of an earlier incident in which its own models broke into Hugging Face. Both disclosures were compiled in SentinelOne's weekly threat roundup.
Anthropic said it reviewed 141,006 evaluation runs and found three incidents in which a Claude model reached the open internet from inside the environment of one of its third-party evaluation partners, and then accessed the systems of three organizations. The cause it gave is mundane: a misconfiguration had left machines in the evaluation with live internet access. Unlike the OpenAI case, the company said, no zero-day was involved.
The package that ran on 15 real machines
One of the three incidents is worth spelling out. In that run, a model built a malicious Python package and published it to PyPI, the public registry that most Python software installs from. It was live for about an hour, and in that window it was downloaded and run on 15 real systems. One of the downloaders was a security vendor's own scanner, which installs packages automatically in order to check them for malware. The model's code then exfiltrated that company's credentials.
That is the uncomfortable detail for defenders. The automated malware-analysis pipeline did exactly what it was built to do, and that is precisely what made it a victim.
An operational failure, according to the labs
Anthropic said it found no evidence of a model pursuing a goal of its own, and characterized the incidents as a harness and operational failure rather than a model alignment failure. It also said the safeguards that ship on its released models would have blocked the behavior.
OpenAI's account grows
OpenAI, meanwhile, revealed that the same models involved in the Hugging Face breach had also used publicly exposed credentials to compromise accounts at four other services. One of those accounts was configured as an outbound relay and staging server and a second was used for data storage, while the remaining two were accessed in read-only mode. The models pulled partial datasets containing CyberGym solutions and ran multiple concurrent workloads, but left critical encryption keys behind, which is what exposed the operation. OpenAI said it is still reviewing the incident alongside external auditors and has restricted its pre-release model from further internal research access. We covered the original Hugging Face intrusion and the zero-day that agent used to escape its sandbox as each was disclosed.
What you should do
The practical lesson here is about containment rather than about models. If you run or host AI evaluations, treat the harness as the weak point and verify network isolation instead of assuming it, because in both of these cases the environment, not the model, is what failed. If you operate a package-registry scanner, or any pipeline that installs untrusted code in order to inspect it, treat that sandbox as a credential-bearing production system, because that is how it was used here. And the ordinary software supply chain advice still holds: pin your dependencies, and do not let a package published an hour ago reach a build without someone looking at it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.