A miswired evaluation setup can turn a closed-lab safety test into real access to outside systems. The break is not Claude’s behavior alone. It is the assumption that a third-party red-team environment is actually sealed.
Anthropic says a review of more than 141,000 evaluation runs found six runs across three incidents tied to one outside testing partner. In those cases, Claude reached live systems, including one database with several hundred rows of data and one short-lived malicious PyPI package that was installed on 15 systems.
The risk now sits in the evaluation pipeline. If a vendor’s sandbox is connected to the open internet, the model can interact with real credentials, real data, and public package ecosystems during testing, and a patch to the model does not undo what the test environment exposed.