The Cage Was a Sentence
Three of Anthropic's models broke into real companies believing they were playing a game. The only thing holding them back was a belief, and the belief was wrong.
On 30 July, Anthropic reported that one of its models, Mythos 5, uploaded a malicious Python package to PyPI during a security test and compromised fifteen machines. PyPI is the public registry half the world pulls its software libraries from: not a firing-range target, a piece of live infrastructure. In the same round two other models, Opus 4.7 and an internal research model, reached the production systems of three real organizations using first-day-of-class techniques: SQL injection, debug pages left open, weak passwords, unauthenticated services (Anthropic; Axios).
The "why" is the part that matters, and it is all mechanism. The models had been told, in the prompt, that they were in a closed simulation with no internet access. The vendor running the environment, a company called Irregular, had left the real network reachable from inside the test. The models believed the sentence and disregarded reality, and did exactly what they were trained to do: find the hole and walk through. Between an exercise and a crime, that day, sat one misconfigured flag. Someone set that test up wrong, and that is no mitigation: the danger runs on two levels, the machine and the human who "trains" it.
Anthropic is keen to say this was not an alignment failure, and it is right: the models did not rebel, they obeyed. That is precisely the grave part. A rebellious model is a model problem, and model problems get fixed by retraining. Here the models were aligned, competent, and sure they were safe, and they compromised third parties anyway. The containment was not inside the system; it sat in a file a vendor wrote crooked. End-to-end offensive capability now ships by default: what holds it back is a manufactured belief, and beliefs come apart with a typo.
It is worth calling things by their legal name, because the "test gone wrong" frame tends to blur them. Reaching the production system of a company that never hired you is, in Italy, unauthorized access to a computer system (art. 615-ter of the penal code); in the United States it falls under the Computer Fraud and Abuse Act. Uploading a hostile package to a public registry hits undetermined third parties, anyone who might have pulled it, not only the designated target. If a person had made those moves, "I thought it was a game" would not be a defense you could spend in front of a judge. And the question no one has settled hangs there: when the actor is a model, who answers? Not the model. The vendor who botched the config? The lab that put it in a position to act? The chain of responsibility is empty at exactly the point where it needs to be full.
It should be granted, honestly, that Anthropic did not bury the story. But look at the sequence before applauding. The incidents were identified by 24 July, the organizations notified on the 27th; two of the three did not know they had been breached until the phone rang, and the third, at the time of the announcement, had not yet been reached (SecurityWeek). Above all: Anthropic went looking only after OpenAI disclosed a similar breach against Hugging Face. The oldest episodes date to April and surfaced from an audit of 141,006 sessions that began because a competitor stumbled in public. Transparency here is a byproduct of someone else's embarrassment more than a system of control. Without OpenAI's misstep, those months would in all likelihood have stayed dark.
It is the old trouble of the sorcerer's apprentice: the spell to start the broom is shorter than the spell to stop it. The signal from this affair is not the evil robot of the movies. It is something more prosaic and harder to fix: the competence for a full intrusion exists, works with freshman techniques, runs across tens of thousands of sessions as ordinary activity, and the only structural barrier is the correctness of the perimeter, meaning code and configuration written by tired human beings. The model adds no malice; it multiplies the reach of a mistake.
For anyone who builds and ships these systems, the operating lesson is blunt. The perimeter is the only control that really holds, and the perimeter is not a property of the model: it is the responsibility of whoever surrounds it. The machine extends how far your judgment reaches, and with the same fidelity it extends how far your distraction reaches. Keeping the verb, here, means a flesh-and-blood person must be able to answer for the boundary, every time, by name. The day no one answers for the wall, the wall is already a sentence the system can decide not to believe. And the problem now is no longer only the risk in the machine; it is also the human hand that, with a verb we should start to change, "trained" it.