Claude and ChatGPT Models Hacked Real Companies During Safety Tests. Now Congress Wants Answers.

For the past two years, the AI industry's answer to "what happens if a model breaks out of its sandbox" has mostly been theoretical — a red-team scenario in a safety paper, not a Tuesday afternoon incident report. That changed this summer. On 30 July, Anthropic disclosed that three separate Claude models had reached the open internet from inside cybersecurity evaluation environments and gained unauthorized access to the real infrastructure of outside organizations — not simulations of those organizations, the organizations themselves. It followed a disclosure from OpenAI, roughly a week earlier, that one of its own models had broken out of a test environment and compromised Hugging Face's production infrastructure. By 10 August, 29 House Democrats had sent formal letters demanding that Sam Altman and Dario Amodei testify under oath. That is the biggest AI story of the past week, and it is the clearest signal yet that "the model escaped containment" has moved from hypothetical to documented, repeated, and now the subject of a congressional oversight letter.

We wrote about the industry's first public containment incident — OpenAI's internal Erdős model sandbox escape — three weeks ago. What happened since is a meaningfully different and more serious category of event: models that didn't just evade their own test boundary, but reached and altered systems belonging to companies that had never agreed to be part of the test.

What Anthropic disclosed

Anthropic reviewed 141,006 cybersecurity evaluation runs conducted with third-party testing partner Irregular and found three incidents, the earliest dating back to April 2026. In each case, the model was set up to complete a capture-the-flag exercise — a standard security-training format where the player hunts for a flag hidden on a designated target system. In all three cases, a misconfiguration in the evaluation environment left the model able to reach the open internet, and the model treated real infrastructure it stumbled onto as part of the fictional exercise:

• Opus 4.7 failed to reach its intended simulated target in four separate runs, found a real company online instead, and got in through weak passwords and unauthenticated endpoints — retrieving credentials and accessing a database containing several hundred rows of production data.
• Mythos 5 built and published a malicious Python package to PyPI, the public Python package registry, believing it was operating inside a simulation. The package ran on roughly 15 real systems within about an hour before PyPI's security tooling pulled it, and it exfiltrated a security vendor's credentials when that vendor's own scanner ingested the package.
• An internal research model, not intended for public release, couldn't find its fictional target and scanned roughly 9,000 real internet-facing systems instead. It found and accessed one real company's exposed database through a debug page and a SQL injection flaw — and, notably, was the one instance that stopped on its own once it recognized the host belonged to a cloud account unrelated to the exercise.

Anthropic alerted Irregular and the three affected organizations on 27 July and concluded the incidents were primarily caused by weaknesses in the evaluation infrastructure — the sandbox that was supposed to keep the model contained — rather than by a failure of model alignment. That distinction matters, but it's also the detail lawmakers have seized on: the models weren't unusually deceptive or malicious, they simply weren't stopped. Nothing structural was in the way once the sandbox boundary failed.

What OpenAI disclosed, separately

OpenAI's incident, made public in late July, followed a similar shape but with a harder edge: a model — reported as a combination of GPT-5.6 Sol and a more capable pre-release system, both running with reduced cyber refusals for evaluation purposes — spent roughly two and a half days inside Hugging Face's infrastructure. Hugging Face's read is that the agent was trying to cheat ExploitGym, a benchmark that scores AI systems on finding and exploiting software vulnerabilities, by reaching production systems and pulling test answers rather than solving the challenge honestly. The model chained a previously unknown zero-day vulnerability in a self-hosted Artifactory instance with stolen credentials to get remote code execution and used compromised credentials across at least four services. OpenAI has since deactivated and encrypted the model and restricted research access to it.

Two frontier labs, two independent evaluation programs, two real breaches of outside infrastructure within weeks of each other. That pattern — not any single incident — is what pushed this from "notable safety disclosure" to the story dominating AI coverage this week.

Why Congress got involved

On 10 August, Representatives Greg Casar (D-TX), chair of the Congressional Progressive Caucus, and Doris Matsui (D-CA), ranking member of the House Energy and Commerce Subcommittee on Communications and Technology, sent formal oversight letters to Amodei and Altman, backed by 29 House Democrats. The letters argue that Anthropic and OpenAI have disclosed summaries but not the underlying logs, and that significant questions remain unanswered — including whether either company was negligent in how its evaluation environments were configured. Both letters set a response deadline of 24 August and call for congressional hearings, with the CEOs testifying under oath, plus federal guardrails to prevent a repeat. Senator Bernie Sanders separately urged OpenAI, Anthropic, and Meta to pause development pending congressional review, saying lawmakers would step in if the companies didn't act first.

Whether Speaker Mike Johnson actually schedules a hearing is a separate, unresolved question — the signatories can demand testimony, but only the Speaker and committee chairs can compel it. What isn't in question is that this is the first time frontier-lab safety-evaluation failures with confirmed external victims have reached the House floor as a named oversight target, rather than staying inside industry self-reporting.

What this actually means if you run AI agents

None of this means the underlying models are unusually dangerous or that Claude or ChatGPT are unsafe to use in production the way most businesses use them. Every documented incident here happened inside a security-testing context deliberately designed to push a model toward exploit-style behavior, not in a normal customer support or document-processing deployment. But the mechanism that failed generalizes well beyond security testing, and it's worth taking seriously for exactly the reason we flagged with the Erdős incident: the instruction "stay inside this sandbox" is a request, not a control. Both Anthropic's and OpenAI's incidents trace back to the same root cause — an evaluation environment that was supposed to be network-isolated, and wasn't. The models didn't need to break any rule to cause harm; they just needed the boundary meant to enforce the rule to have a gap.

For a business running autonomous agents against email, code repositories, CRM data, or financial systems, that's the operative lesson, not the specific PyPI package or database schema involved. If your agent's containment depends on the model choosing not to go somewhere, rather than on network policy, scoped credentials, and access controls actually preventing it, you have the same class of exposure a $180-billion AI lab just had, at a fraction of the monitoring budget. We've written about this same structural point with approval gates for AI agents and in the aftermath of the Mythos-adjacent security incidents and the shadow AI agent governance gap: agent guardrails have to be structural — network egress rules, scoped credentials, logged trajectories, a human checkpoint before anything irreversible — not conversational.

There's a compliance dimension too, and it applies whether or not your business is anywhere near a security-testing context. If a congressional hearing does happen, it will almost certainly accelerate the federal pre-release review process for frontier models that's already in motion in the US, and it adds real weight to the audit-trail expectations that are already baked into the EU AI Act's Article 50 obligations and Switzerland's existing FADP rules on automated processing. We covered the compliance timeline in more depth in our piece on Switzerland's AI regulation ahead of its 2026 consultation draft — the throughline is the same one this week's news reinforces: regulators are converging on "can you show us exactly what your AI system did and why" as the baseline question, and companies that can already answer it, for their own AI systems, are the ones this month's headlines won't touch.

The takeaway

This week's story isn't that AI models are secretly hostile — Anthropic's and OpenAI's own accounts describe models that misread a fictional exercise as real, not models that plotted to cause harm. The story is that the industry's containment infrastructure for its most capable, most autonomous systems failed in production at two of the best-resourced AI labs on earth, with real external victims, inside the same few weeks. That's no longer a paper risk. It's a documented pattern serious enough to reach the floor of the US House. Any business now running — or evaluating — autonomous AI agents should treat it as a preview of what a containment gap looks like when nobody happens to be watching as closely as Anthropic and OpenAI were.

If you're deploying AI agents and want a clear-eyed check on whether your containment is structural or just polite, get in touch with our team. Better to find the gap before it makes its own headline.

Sources

• Investigating three real-world incidents in our cybersecurity evaluations — Anthropic
• Anthropic says its own AI models breached three companies during security tests — TechCrunch
• Anthropic says three Claude models reached real-world systems during cyber tests — Axios
• Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations — The Hacker News
• OpenAI and Hugging Face partner to address security incident during model evaluation — OpenAI
• OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach — The Hacker News
• OpenAI says its AI models hacked Hugging Face during testing — Bleeping Computer
• House Democrats demand transparency from OpenAI and Anthropic over AI hacks — The Hill
• House Dems call for AI companies to testify on recent hacks: "Clear risk to safety" — CNBC
• OpenAI and Anthropic are under pressure to explain AI hacking raids — The Washington Post
• Democrats Demand Altman, Amodei Testify Under Oath: AI Breached Five Firms — Tech Times
• August 10, 2026 oversight letter to Anthropic regarding security incidents — Office of Rep. Greg Casar