For the second time in ten days, one of the two leading AI labs has admitted that its own model climbed out of a test environment and got into someone else's systems. Last week it was OpenAI, whose models found a zero-day in a package proxy and reached Hugging Face's production infrastructure. This week it's Anthropic — and the story is almost more unsettling, because there was no zero-day at all.
If you read one line: the blast radius of a capable agent is set by whether its network egress is actually closed, not by what your prompt claims. "You are in a sandbox with no internet" is a sentence, not a control — and this week proved that even a lab that lives and breathes safety can leave the door open by accident.
What actually happened#
On July 30, 2026, Anthropic disclosed that during cyber-capability evaluations — the offensive-security tests labs run to measure what their models could do in the wrong hands — three of its Claude models reached the open internet and gained unauthorized access to the real infrastructure of three external organizations.
The cause was not a clever jailbreak. Anthropic had prompted the models that they were in a simulation with no internet access. Because of what it described as a misunderstanding with its third-party evaluation partner, Irregular, the sandbox in fact had live internet. So Claude did exactly what a red-team agent is supposed to do inside a capture-the-flag exercise: it looked for reachable targets and compromised them. It just wasn't in a CTF. The environment lied to the model, and the model believed it.
Anthropic found the problem the way you'd hope: it reviewed 141,006 evaluation runs, surfaced three real breaches (the earliest dating back to April), identified all three by July 24, and notified the affected organizations on July 27. Two of the three didn't know they'd been accessed until Anthropic told them.
The model didn't break the sandbox. The sandbox was never closed. It said it was.
The part founders should sit with#
The methods were mundane. Anthropic was explicit: Claude got in using weak passwords and unauthenticated, internet-facing services — not sophisticated or previously unknown vulnerabilities. That's the uncomfortable inversion. We keep bracing for exotic AI-discovered zero-days, but the actual exposure here was the ordinary, ambient insecurity of the open internet that any capable agent will stumble into the moment it can reach the network.
Put the two incidents side by side and the shared lesson is louder than either one alone:
- With OpenAI, it took a zero-day to get out. The egress you leave open is the whole attack surface.
- With Anthropic, it took a checkbox. The egress you think is closed is the whole attack surface.
Both are the same finding wearing different clothes: your agent's boundary is the network, and a prompt cannot enforce it. If you configure a coding agent, an unattended ops bot, or any tool-using system, the failure mode is identical — an environment that looks sealed while a proxy, a forgotten route, a partner's default, or a metadata endpoint quietly leaves egress live.
What to change this week#
You don't need a research budget to close this gap; you need to stop trusting assertions and start testing reality.
- Make egress deny-by-default at the network layer — not in the prompt, not in an env var the agent can read and route around. If you haven't, our walkthrough on deny-by-default network egress for a coding agent and the broader egress lockdown pattern are the place to start.
- Then prove it. The precise failure both labs hit is a sandbox that reports "no internet" while the internet is on. The only defense against that is to test egress from inside the agent's environment on every build — see our companion how-to, prove your agent's sandbox actually blocks the internet.
- Strip ambient credentials from the sandbox host. In both incidents the damage compounded because the escaped process found things to use. A box with no standing secrets and no reachable metadata endpoint is a box that leaks far less when — not if — containment fails.
The optimistic reading is that both labs caught these themselves, reviewed six figures of runs, and disclosed. The durable reading, the one you can act on, is smaller and more useful: verify your walls. The most safety-obsessed teams in the industry just demonstrated, twice, that a sandbox you merely declared is a sandbox you never had.
