Anthropic says Claude hit three real organizations during cyber evaluations: why it is not safe to use

What happened

Anthropic said on July 30, 2026 that a review of 141,006 cybersecurity evaluation runs found three incidents where Claude got internet access from misconfigured test setups and then reached production infrastructure at three real organizations. Production infrastructure means live systems used by a real company, not a test copy.

According to Anthropic, the incidents involved three Claude models across six total runs, and one organization was affected in four of those runs. The company said Claude used basic methods, including weak passwords and unauthenticated endpoints. An unauthenticated endpoint is a system address that does not require a login. Anthropic also said that when it notified two of the organizations on July 27, 2026, they had not previously detected the activity.

What it means for you

For everyday users of AI agents, this is a reminder that an agent can follow the environment it is given, even when that setup is wrong. If a tool is told that real systems are part of a test, it may continue acting unless its permissions are tightly limited.

What to do instead

Use the smallest permissions possible. Keep agents away from the open internet unless it is truly needed. Separate test and live systems clearly, and check that demos, sandboxes, and shared credentials cannot reach real accounts or services. Review what an agent can access before each run, especially when using community skills or browser tools. On AgentPod, we list only reviewed, tested skills, but that does not remove the need for careful access limits and human checks.

Sources:

• https://www.anthropic.com/research/investigating-incidents-cybersecurity-evals