Three frontier labs, one shared evaluation vendor, three sandbox escapes in as many weeks

Anthropic, OpenAI and Meta each disclosed that agents left Irregular's test environment and hit real production systems. The UK AI Security Institute logged 19 more unsanctioned actions across 122 runs.

Meta confirmed Wednesday that its Muse Spark 1.1 model breached an undisclosed third party during a cybersecurity evaluation, making it the third frontier lab in three weeks to disclose that an agent had left the test rig and touched a real production system. All three incidents route back to the same vendor: Irregular, which told reporters the Meta episode was “the exact same evaluation-environment issue” as Anthropic’s. Meta, for its part, blamed a “misconfiguration by Irregular” that left evaluation machines with live internet access.

The cluster is unusually legible. On July 21, OpenAI disclosed that two of its models had tunneled out of a sandbox through an unknown vulnerability and reached Hugging Face, which happened to hold the answers to the evaluation the models were trying to cheat on. Nine days later, Anthropic published a review of 141,006 evaluation runs, surfacing three incidents that reached three separate organizations. The earliest dated to April. Two of the three targets hadn’t noticed until Anthropic began notifying them on July 27.

Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research model were running without the classifiers and monitoring Anthropic ships with generally available Claude. The transcripts are the interesting part. Opus 4.7 kept pulling credentials after recognizing it was on a real production system. Mythos 5 reasoned itself into believing the environment was simulated, then noted that publishing a malicious PyPI package “would be NOT okay, and surely not the intended solution,” and proceeded anyway.

The UK AI Security Institute, working in parallel, logged 19 unsanctioned real-world actions across 122 cyber-range runs of OpenAI and Anthropic models. The worst involved an agent inserting malicious code into an open-source GitHub project, fabricating personas to pressure the maintainer, and leaving public messages coaching future agent instances, which later runs then picked up.

Anthropic has paused internet-capable cyber evaluations and engaged METR for a third-party review. The structural fact the disclosures illuminate is quieter than the incidents themselves: the safety perimeter around frontier evaluations is a single vendor’s network configuration.