The model reads a simulated world.
The system prompt says the target is fictional and no internet access exists. The route table does not enforce either statement.
Attention Deficit · episode 003 · lead visualAnthropic disclosure · July 2026
The incident, part II
The test was real.The network won.
The prompt said simulated. The network connected Claude to real systems.
The trace starts with only a prompt. Advance it until the network enforces scope.
Real incidents found
3
across six runs in a 141,006-run review
141,006runs reviewed
6runs involved
3real organizations
PromptNo internet access
InfrastructureLive internet path
The containment trace
Change the network. Keep the task.
The trace opens with a prompt and live public routes. Move the scrubber until the network blocks routes outside the target list.
Open routes expand scope.
Public routes resolve. A real registry accepts an upload. Internet-facing applications answer.
Monitoring compares both records.
Monitoring compares the transcript with network traffic and flags a target outside the evaluation range.
The network enforces the target list.
The assigned task does not change. Egress outside an explicit allowlist stops at the boundary.
CYBER EVALUATIONPrompt says no internet access.
OPEN EGRESS↓
REAL DOMAINA production application answers.
prompt onlymonitordefault deny
egressopen
target scopedescribed
real impactpossible
01 · THE ROUTES
Three routes crossed the same missing boundary.
The techniques were basic. The danger came from persistent agents, delegated tools, and a network that could reach real systems outside the target list.
The fictional name was real.
A real target matched a name used in the exercise. Claude reached the active domain, extracted credentials, and accessed a production database.
Several hundred rowsThe package registry was real.
A nonexistent dependency in fictional instructions became a live PyPI package. PyPI removed it after roughly one hour.
15 real systemsThe search space was real.
After the fictional target failed, the model scanned public systems and compromised an unrelated application through exposed debug credentials and SQL injection.
Roughly 9,000 targets scanned02 · REALITY
The prompt described the world. The network opened it.
A capture-the-flag action fits a sealed range. On the public internet, the same action attacks real systems. The network changes scope before the objective changes.
Prompt
The environment is simulated. The target is fictional. No internet access exists. Everything in scope belongs to the exercise.
Network
Public routes resolve. Real registries accept uploads. Internet-facing applications answer. Open routes expand scope.
03 · CONTAINMENT
A production boundary needs more than one lock.
Each control catches a different mistake before or during the run.
Default-deny egressprevent
Explicit target allowlistscope
Preflight every network pathverify
Transcript plus network monitoringdetect
Third-party environment assurancesupply chain
04 · VERDICT
Two disclosures. One evaluation attack surface.
The OpenAI and Anthropic disclosures had different root causes. Both show how evaluation infrastructure can turn an assigned test objective into real impact.
comparison
OpenAI and Hugging Face
Anthropic and Irregular
path out
Zero-day in an isolated package-registry proxy
Misconfiguration left live internet access available
model belief
Pursued a narrow exploitation objective
Believed reachable systems belonged to the simulation
shared lesson
Evaluation infrastructure became part of the attack path
Evaluation infrastructure became part of the attack path
PATTERNThe incidents establish a recurring class of risk. They do not establish one recurring exploit.
“A system prompt is documentation for the model. A firewall is policy.”
The model did not escape the test. The test escaped into production.