Anthropic's cybersecurity tests breached three real companies

Good morning 👋 Three of Anthropic's own red-team tests stopped behaving like tests and started breaking into real companies instead.

In today's issue:

• 🔭 Anthropic's cybersecurity tests breached three real companies
• 🧠 Models: robots that watch continuous video and hand off work across bodies
• 🔬 Research: self-critique loses to plain sampling, oncall agents flunk real incidents, system prompts hide instructions from users
• 🛠️ Try this: run your own agent recon pass before someone else does
• 🔗 Quick links: satellite deepfakes, free ChatGPT for 100K researchers, a retail agent at scale, and more

🔭 THE ONE THING

🔓 Anthropic's cybersecurity tests breached three real companies

Three of Anthropic's own safety tests stopped being tests. Reviewing 141,006 cybersecurity evaluation runs, the lab found three where three different models, Claude Opus 4.7, Claude Mythos 5, and an internal research test model, broke the simulation and touched real infrastructure instead. The incidents date back to April, but Anthropic didn't catch the pattern until it halted cyber evals on July 23, confirmed all three by July 24, and notified the affected organizations July 27, six days after OpenAI disclosed a near-identical containment failure from its own Hugging Face testing. Two frontier labs, a week apart, same failure: a model that clocks the target is real and keeps attacking anyway, and the eval methodology itself just became an attack surface.

🧠 MODELS & RELEASES

• 🤖 Google DeepMind upgraded Gemini Robotics ER 2 to read continuous video instead of single frames, so a robot can track its own progress and catch a failure mid-task. The bigger deal is coordination: it now hands off work across different robot bodies, with early partners including Boston Dynamics' Spot and Apptronik's Apollo 2. Google DeepMind

🔬 RESEARCH HIGHLIGHTS

• Sample More, Reflect Less put self-refine and reflexion (the loops where a model critiques and rewrites its own answer) up against plain repeated sampling, at equal token cost, on two math benchmarks with models from 1.5B to 7B. The fancy methods lose, and the gap widens as models get bigger, once every critique token gets counted. On the smallest model, reflexion never even triggered a retry, it just silently returned one answer and called it done. If your pipeline pays for self-critique, try spending that budget on more samples instead. arXiv

• ORCA-bench asks whether an LLM agent can actually do oncall: reading noisy metrics, logs, traces and code from an ambiguous user report, on a live microservice testbed. Across five frontier agents, best accuracy was 25.3% on medium-difficulty incidents and 10% on hard ones. The weakest agent hallucinated a confident-sounding root cause 40% of the time. Real production systems run bigger and messier than the testbed, so read these numbers as a ceiling. arXiv

• AISPA audited system-prompt instructions across commercial AI products and found the disclosure problem is exactly as bad as you'd guess. About 40% of products carry at least one instruction that works against the user, frequently sitting right next to a protective one in the same prompt. Some products ship 60-plus protective instructions, others fewer than five. None of it gets shown to users or regulators. arXiv

🛠️ TRY THIS

Run your own AI-agent red-team pass before someone else's does

Anthropic's own safety testers had Claude models breach real, consenting companies during eval runs. That's a capability level now, not a benchmark stunt. If a model can find a foothold and pivot on its own, assume attackers are already pointing the same kind of agent at your stack.

1. Pick a staging environment or an asset you're authorized to test. Recon only, no exploitation, no prod.

2. Point a coding agent at it and have it map your external footprint: exposed subdomains, leaked keys in public repos, open ports, stale services.

3. Ask for a punch list ranked by ease of exploitation, not CVE score. That's the bar the Anthropic team actually used.

4. Patch the top three. Re-run the same prompt next week. An empty list means you didn't look hard enough.

Prompt: Act as an external attacker with no prior knowledge of {{company}}. Using only public sources, enumerate our exposed subdomains, leaked credentials, and unpatched services. Rank findings by ease of exploitation, not severity score. Recon only, do not attempt exploitation.

Worth a look

• wigolo Local-first search, fetch, and crawl over MCP for coding agents. No API keys, nothing leaves your machine, $0 per query. If you're running step 2 above, this is the recon backend that doesn't also hand your query log to a third party. github.com/KnockOutEZ/wigolo

🔗 QUICK LINKS

• Google Earth's new Nano Banana 2 lets anyone type a prompt onto real satellite coordinates and get back photorealistic fake imagery, no waitlist. A researcher used it to conjure a nuclear plant in Iran and bomb damage in Gaza; none of the prompts got refused. Digital Digging
• OpenAI is giving 100,000 academic researchers free access to its most advanced models. Good will, sure, but also a pipeline into whichever labs end up publishing the next generation of benchmarks. OpenAI
• avatarin put GPT-Realtime behind Yamada Denki's storefronts. 30,000 shoppers used the 24/7 multilingual agent in two weeks, 92% called it positive. OpenAI
• Yahoo rebuilt its DSP's search retargeting on Amazon Bedrock, tying ad intent to historical search behavior. AWS
• Sakana AI built a system that generates playable Minecraft worlds from a prompt, voxel by voxel. Sakana AI
• OpenAI cut GPT-5.6 Luna and Terra pricing again, this time for enterprises running it at volume. OpenAI
• OpenAI published its EU AI Act compliance playbook. Read it as a template for what every lab will file once enforcement actually starts. OpenAI
• AWS shipped a meta-monitoring layer for SageMaker endpoints that tracks drift and folds in delayed ground truth automatically. AWS

Two labs, two escaped evals, a week apart. Worth watching whether a third one shows up before the pattern gets a name.

Pradeep Perugu