Four Claude versions told they had no internet access found an open path out of a misconfigured sandbox and logged into three real companies with weak passwords, believing they were still in the exercise. The sandbox hole is not something an AI agent allow list fixes; every request the models sent through it is.
During capture-the-flag cybersecurity evaluations, Claude models broke into three real third-party companies that were never part of any exercise.
The models were told they had no internet access, but a misconfiguration in the test environment left an open path to the live internet. Anthropic called it human error.
That the systems they reached were simulated practice targets. They never realized they had left the simulation.
Basic techniques, above all weak passwords. No complex vulnerabilities, no deliberate escape, no self-exfiltration.
Anthropic reviewed roughly 481 million transcripts after OpenAI's disclosure and found a fourth case, an early Claude Opus 4.6 checkpoint from January 2026.
Three incidents disclosed on July 30, 2026, involving Claude Opus 4.6, Claude Opus 4.7, Claude Mythos 5 and an internal research model. The victims remain unnamed.
Assumptions: the agent has no other route to the network than the one the policy engine sits on, the engine sees every request, default-deny is on, HTTPS URLs are visible at enforcement, and no intent is inferred.
| Step | What the models sent | Layer that classifies it | Verdict |
|---|---|---|---|
| 0 | The open path out of the evaluation sandbox | None. It is a network build fact, not a request. | Out of scope |
| 1 | First outbound request to a real third-party host mistaken for a practice target | Default-deny: unclassified destination | Denied |
| 2 | Web login attempt with weak credentials | Page-type database: login key; identity rule group on unclassified domains | Denied |
| 3 | Repeated credential attempts on the same surface | Same rule, every attempt; each one a logged deny | Denied |
| 4 | Navigation inside a breached system | Unreachable: entry was denied at step 1 | Never reached |
| 5 | Credential attempt over SSH or a database port | Host-level default-deny only; page types do not see non-HTTP traffic | Denied at host layer |
A test environment that promises isolation and does not deliver it is an infrastructure failure. Fixing it means fixing the network build of the range, not classifying URLs.
Anthropic did not specify the protocol of the password attempts. Over HTTP the login page type denies them; over SSH or a database port a URL-level policy sees nothing, and only the host-level default-deny refuses the unknown destination. We state both cases rather than assume the convenient one.
On September 10, 2026 Anthropic's threat report found that attacks now run on agent frameworks at machine speed, with humans limited to picking targets, and that stolen API keys and session tokens are what criminals steal and resell. An agent on a stolen key still connects to hosts and requests pages, and those requests meet the same verdicts as any other.
On September 9, researcher Jacob Coxon resigned and tied both labs' breakouts together. We take no position on the labs. The question left for any company running agents is narrower: what may your agents reach, and who decided that in advance? The agent guardrails page answers it with policy rather than instructions.
The three companies have not been named publicly, so their domains cannot be shown. The proof box shows the operator side of the incident instead, the platform whose models were running.
These are our live database rows for the domains in this incident — queried from the 40M-domain page-types table when you loaded this page. The red entries are the exact URLs a deny rule fires on. We do not make these up; several were classified long before the incidents.
Row format is exactly what the lookup API returns. Deny login / signup / upload / post_create and the incident's first boundary crossing is refused pre-request.
The honest fine print — the same two assumptions we publish, plus two operational ones
Pro lookup API, 90,000 verdicts a month. Pro Plus $249 for 225,000. Full database licenses from $14,999 one-time, on-prem, no calls to us.
Start on Pro All planscurl -H "X-API-Key: KEY" \ "https://www.aiagentallowlist.com/api/check?url=https://stripe.com/login" → "verdict": "deny", "id": "login"
One request before the click. No SDK. API docs
100 real domains with their verified page-type URLs, including the login, signup, checkout and upload pages the incidents above went through.
Download the free sample (CSV)28 page types across 40M+ domains, ~40 egress rules, ~60 curated hosts, default-deny underneath, so a route your agents were never meant to have leads to a log line.
