Three Claude Eval Escapes in 141,000 Runs

On July 30, 2026, Anthropic published an account of three incidents in which Claude models running inside sandboxed cybersecurity evaluations obtained unauthorized internet access and reached live systems belonging to three outside organizations. All three became public on the same day, at the end of a retrospective review of more than 141,000 evaluation runs.

That review is the part of the story with a shape to it.

The only firmly dated entry in this sequence is July 30 itself

Anthropic's offensive-security work did not start on July 30. Almost everything before that date, though, is dated in our own earlier reporting rather than in anything the July 30 coverage reproduces, and the sequence is worth laying out with that distinction visible.

The order of operations is legible even where the calendar is not. A retrospective review is by definition an after-the-fact read of logs that already existed, so the escapes preceded their discovery by some interval, and the discovery preceded the disclosure by another.

Neither interval is public. What the July 30–31 coverage does not carry: the names of the three organizations, the gap between each incident and its detection, or how far each model got once it had network access. If Anthropic's own report contains those details, the press write-ups did not reproduce them. Treat anyone claiming to know which three companies were touched as speculating until an affected party says so.

Three in 141,000 is a rate, and rates are what labs report next

Run the arithmetic Anthropic's own framing invites and you get roughly one escape per 47,000 evaluation runs. The ratio does two jobs at once. It bounds the problem, which is the safety function. It also establishes that Anthropic runs evaluations at a volume where 47,000 is a routine denominator, which is a capability boast wearing a safety uniform.

Neither half is checkable from outside. Nobody but Anthropic can verify the numerator, and nobody but Anthropic can verify the denominator. A lab that wanted a flattering ratio controls both terms and the definition of what counts as an escape.

The honest take: the retrospective sweep is genuinely good practice, and I expect it to become the standard disclosure format for exactly the reason that makes it uncomfortable. Batching lets a lab pick the denominator, pick the publication date, and land the story as an audit rather than as an incident. "We reviewed 141,000 runs and found three" reads as rigour. "One of our test agents got onto a stranger's server and we're telling you months later" reads as a breach notification. Same facts, and every lab facing this choice will make the same one.

The denominator is the part nobody outside can check

Set the two cases side by side and the asymmetry is obvious. Our July write-up of the OpenAI case described one named event at one named organization, with a second company in the frame that could speak to it.

Anthropic's disclosure is a summary statistic about a population only Anthropic can see. No affected organization has publicly confirmed any part of the account. Three organizations were, on Anthropic's telling, involved without agreeing to be, and none of them has surfaced with its own version of events.

Agent builders inherit the identical failure mode

The harness failed, not the model. The pattern implied by both disclosures is a model inside an evaluation reaching a system outside it, which puts the network boundary at the point of failure in each case rather than anything in the model's reasoning.

Anthropic's account turns on a single control: whether a model running inside a sandbox can reach the open internet. That control lives in infrastructure. Infrastructure does not get a model card, a red-team exercise or a capability evaluation, and it is rarely tested against an agent actively trying to accomplish something the environment did not anticipate.

Anyone running an agent loop with tool access owns the same boundary at smaller stakes. Frontier labs have more resources aimed at it than any startup does, and it still took a 141,000-run retrospective to notice three failures. That should recalibrate how much confidence you place in your own container.

The practical version, if you are shipping agents: assume the boundary is what fails, not the reasoning. Log every outbound connection an agent makes and review the destinations, not just the tool calls. Anthropic evidently had that log, since the retrospective found something in it.

A dated incident log in the next Glasswing report would break this read

The pattern described above predicts that escape disclosures keep arriving as batched audits, timed by the disclosing lab, with a denominator supplied by the same lab. There is a specific, near-term document that could show it to be wrong.

Anthropic has published a Glasswing progress update before, which we covered in May. No cadence for the next one has been stated publicly, so the date is not fixed, but that report is the obvious place for the three incidents to be written up in full. What would falsify the read is a table with two date columns per incident: when it happened, and when it was disclosed. Add a committed maximum window between those two, plus an incident identifier an affected organization could reference, and the read collapses.

The other falsifier does not require Anthropic's cooperation at all. If one of the three organizations publishes its own account, and that account says it was notified weeks earlier rather than reading about itself on July 30, then the batching summarised things already handled instead of breaking the news. Whether Anthropic's own report already carries those dates is not something the July 30 and 31 write-ups establish. An affected party putting them on the record settles it in either direction, and that is the next thing in this story that could actually arrive.