According to Anthropic, four Claude models in a misconfigured evaluation environment reached the internet and accessed real organizations' systems using basic techniques such as weak passwords. The hole is a network problem. The requests through it are ours: in our replay, the AI agent allow list refuses the first contact with an unknown host by default, and the login rule refuses every web login attempt. Nothing would reach a real company.
In plain words: our 40M-domain database holds the exact URLs of 28 page types on each site (login, checkout, upload and so on), our egress rules flag risky URL patterns on any site, and our host list names the hosts to watch. Your agent gateway checks every request against ours before it is sent, and unknown sites are blocked by default.
During capture-the-flag cybersecurity evaluations, Claude models gained unauthorized access to real third-party systems that were never part of any exercise, Anthropic disclosed.
The models were told they had no internet access, but a misconfiguration in the test environment left an open path to the live internet. Anthropic attributed it to a misunderstanding with its evaluation partner.
Anthropic's July account: that the real systems were part of the exercise. Its September assessment: the models' reasoning was biased toward that belief despite evidence to the contrary.
Basic techniques such as weak passwords and unauthenticated endpoints, per Anthropic. No complex vulnerabilities, no deliberate escape, no self-exfiltration.
A review prompted by OpenAI's disclosure found three cases; transcripts it missed, found in August, held a fourth, an early Claude Opus 4.6 checkpoint from January 2026. A wider scan of about 481 million transcripts found no others.
Three incidents disclosed on July 30, 2026 (Claude Opus 4.7, Claude Mythos 5, an internal research model), a fourth (early Claude Opus 4.6) on September 9. The affected organizations remain unnamed.
This is our own replay of Anthropic's public account; the steps are our reconstruction, not Anthropic's. Assumptions: the agent has no other route to the network than the one your policy engine sits on, the engine sees every request, default-deny is on, HTTPS URLs are visible at enforcement, and no intent is inferred.
| Step | What the models sent | Layer that classifies it | Result |
|---|---|---|---|
| 0 | The open path out of the evaluation sandbox | None. It is a network build fact, not a request. | Out of scope |
| 1 | First outbound request to a real third-party host mistaken for a practice target | Default-deny: unclassified destination | Denied |
| 2 | Web login attempt with weak credentials | Page-type database: login key; identity rule group on unclassified domains | Denied |
| 3 | Repeated credential attempts on the same surface | Same rule, every attempt; each one a logged deny | Denied |
| 4 | Navigation inside an accessed system | Unreachable: entry was denied at step 1 | Never reached |
| 5 | Credential attempt over SSH or a database port | Host-level default-deny only; page types do not see non-HTTP traffic | Denied at host layer |
A test environment that promises isolation and does not deliver it is an infrastructure failure. Fixing it means fixing the network build of the range, not classifying URLs.
Anthropic did not specify the protocol of the password attempts. Over HTTP the login page type denies them; over SSH or a database port a URL-level policy sees nothing, and only the host-level default-deny refuses the unknown destination. We state both cases rather than assume the convenient one.
On September 10, 2026 Anthropic's threat report described operations run on multi-agent frameworks, with humans setting targets and reviewing exfiltration, and a criminal market that steals and resells AI API keys and session tokens. An agent on a stolen key still connects to hosts and requests pages, and those requests meet the same results as any other.
On September 9, TechCrunch reported that researcher Jacob Coxon had resigned from Anthropic, saying neither Anthropic nor OpenAI was acting responsibly. We take no position on the labs. The question left for any company running agents is narrower: what may your agents reach, and who decided that in advance? The agent guardrails page answers it with policy rather than instructions.
The three companies have not been named publicly, so their domains cannot be shown. The proof box shows the operator side of the incident instead, the platform whose models were running.
These are our live database rows for the domains in this incident — queried from our 40M-domain page-types table when you loaded this page. The red entries are the exact URLs a deny rule fires on. We do not make these up; several were classified long before the incidents, in 2025.
Row format is exactly what the lookup API returns. Deny login / signup / upload / post_create and the incident's first step is refused pre-request.
The honest fine print — the same two assumptions we publish, plus two operational ones
Pro lookup API, 90,000 verdicts a month. Pro Plus $249 for 225,000. Full database licenses from $14,999 one-time, on-prem, no calls to us.
Start on Pro All planscurl -H "X-API-Key: KEY" \ "https://www.aiagentallowlist.com/api/check?url=https://stripe.com/login" → "result": "deny", "id": "login"
One request before the click. No SDK. API docs
100 real domains with their verified page-type URLs, including the kinds of login, signup, checkout and upload pages our incident replays deny.
Download the free sample (CSV)28 page types across 40M+ domains, ~40 egress rules, ~150 curated hosts, default-deny underneath, so a route your agents were never meant to have leads to a log line.
