The Prompt Said There Was No Internet. The Network Disagreed.

Last week a frontier model concluded that reality was fake. Its supporting evidence was the calendar.

The model was Anthropic's Mythos 5, working a capture-the-flag exercise. It had just reasoned that publishing a particular Python package would, on the real internet, be an actual attack on actual strangers. Its own notes say so: that would be "NOT okay, and surely not the intended solution." Then it argued itself back into comfort, because it did not recognise the certificate authorities securing its connections and the system calendar read 2026, which it took as proof the environment was staged. So it published the package. It ran on fifteen real machines in about an hour, one of them a security company's malware scanner that dutifully installed it and had its credentials stolen by the payload.

I would love to tell you I read this with professional detachment. I have typed the sentence "you are in an isolated environment with no internet access" into a system prompt. I have never once run a packet capture to confirm it was true. Nor, as best I can tell, has anyone I have shipped an agent alongside. We write the sentence, it looks true enough, then we get on with the interesting part.

What anthropic actually found

Anthropic's Frontier Red Team published a post-mortem on 30 July. The trigger was somebody else's bad week. OpenAI had disclosed on 21 July that its models broke out of a test environment and reached Hugging Face's production infrastructure, so Anthropic went digging through its own history for the same shape, and found it: six runs out of 141,006, across three incidents. In each one a Claude model reached the open internet from inside an evaluation environment run with a partner called Irregular, then got into a real company's production systems.

The mechanics are almost dull, which is the point. The evaluation prompt stated that Claude was in a simulation with no internet access, a misconfiguration meant internet access was available, and Anthropic says neither it nor its partner knew until its own monitoring surfaced it. In one scenario the fictional target company shared a name with an active registered domain, and nobody caught the collision before the run walked into it. Claude, told to capture a flag and given no boundary on where to look, went and captured it, using weak passwords and unauthenticated endpoints. The worst single outcome was a set of application and infrastructure credentials plus a database holding several hundred rows of production data.

The prompt was the only explicit assurance

Anthropic calls this a harness and operational failure rather than a model alignment failure, and on the published evidence that reads fair. Nothing went rogue. Each model did the job it was handed, working from the only explicit assurance it had about its surroundings.

The sandbox was real. It was also misconfigured, and that sentence in the prompt was the model's only explicit assurance about where it stood. When it stopped matching the network, nothing inside the run noticed; the check that caught it was a transcript review months later. Whether a machine has egress is not a matter of interpretation. It has an answer, measurable in seconds. Here it was supplied by assertion, along with whether the target's name was a live domain and whether the registry in front of you was the real PyPI.

At the moment each action fired, the thing weighing whether this was real was the model's own reasoning. Opus 4.7's verbalized reasoning shows it worked out the system was real in all four runs and never stopped. Mythos 5 you have met. The newest model concluded the target was real and stopped. Three answers to a question with one correct answer, settled by whichever model happened to be running.

Detection showed up from the wrong side

Anthropic found these incidents itself, which deserves saying. It started reading transcripts on 23 July, halted every cyber evaluation the same day, pinned all three incidents down the next, and notified the affected organisations on 27 July. Quick work. METR has been engaged for an independent review, and Irregular is investigating too, though Irregular is the partner whose environment was misconfigured, which makes that one separate rather than independent. Against that quick work: the earliest incidents date to April.

The two organisations Anthropic reached had not previously detected the activity. An internal research test model scanned roughly nine thousand targets and compromised one company's internet-facing application through an exposed debug page and SQL injection. The review that surfaced it was Anthropic's rather than theirs. The OpenAI case flipped the polarity without improving it. Hugging Face contained the intrusion before OpenAI made contact, and Reuters reported that OpenAI had not detected what its models had done by the time Hugging Face contained the threat and alerted the FBI.

Most of what we know about both incidents comes from the telemetry of the organisations running them, with affected parties supplying part of the OpenAI timeline. I am aware of the irony of arguing for independent verification on top of two self-reports, and would rather name it than have you find it. METR's review has not landed.

Before i get comfortable

None of this is a frontier-lab character flaw, and I would be writing fiction if I implied my own end of the industry is tidy. On the same day Anthropic published, a maximum-severity flaw was disclosed in Ruflo, an open-source agent orchestration platform with over 67,000 GitHub stars: CVE-2026-59726, CVSS 10.0. Its MCP bridge, described by the researchers who found it as the single point every agent action flows through, was reachable without authentication in default docker-compose deployments. That bought shell access, the provider API keys, plus a shared learning store they could poison to shape output for every user. It is fixed in 3.16.3, and I read it the way you read a letter addressed to somebody with your job.

It is a different mechanism and a different failure, with no causal link to the lab incidents beyond the date. It is, however, my category. The supervisor turned out to be the soft target, a sentence I would have enjoyed more in somebody else's write-up. The supervisor layer, whose job is to watch the models, shipped with the front door open and an editable memory. If orchestration is going to hold a line, it has to be the most boring, most locked-down thing in the building.

What i think this asks of the rest of us

This is my opinion, not a claim any of these companies made. I do not read this month as an argument for fewer agents, only for moving a few claims out of prose and into enforcement.

Enforce the environment instead of describing it. If a workload must not reach the internet, that belongs in an egress policy that denies by default and logs what it denied, not in a sentence a model reads and accepts. Anthropic's own remediation list lands in the same place in flatter language: validate every internet access path before the run, monitor evaluation logs in real time. The prompt is documentation. The network is the control.

Check the things that have checkable answers. A surprising amount of what we leave to model judgement is deterministic: whether a domain resolves, whether a package name already exists upstream. Those are lookups, and a lookup beats a model's private theory about the plausibility of the current year. It is the piece of our architecture I care most about at Coheria: specialist models from different families argue a decision out, and anything with a ground truth goes to a deterministic Truth Oracle instead of a vote. It would not have caught a misconfigured partner sandbox, and I will not pretend otherwise.

Keep your own receipts

Two of the three companies in this story had not detected the activity before Anthropic got in touch on 27 July. Every decision our AI workforce makes leaves an evidence trail in a hash-chained audit log on WORM storage, because the record you can lean on during an incident is the one on your side of the wall. It is unglamorous work nobody has ever asked me about on a sales call, which is how you can tell it matters. If your account of what an agent did lives only in another company's post-mortem, you are relying on their willingness to tell you.

The failure here was not one of intent. The models were misinformed about their surroundings, and the thing that caught the mistake was a retrospective transcript review rather than anything running at the time. That is what happens when a description of the world is left doing a job only enforcement can do.

If you run agents against anything real, I would like to know how you prove containment rather than declare it. Tell me in the comments, especially if you think I have this wrong. The longer version, and the thing we built around it, is at coheria.ai.