Plain-English Briefing

The AI didn’t escape. The fence wasn’t there.

By Charlie Essex · 31 July 2026 · 5 minute read

Anthropic has published a report saying three of its Claude models broke into the real systems of three companies during security testing. The headlines went with “AI escapes”. I read the report — that isn’t what happened, and what did happen is more useful to a business owner than the science-fiction version.

This is the third time in a fortnight I have written about a model getting somewhere it shouldn’t. The first was OpenAI’s models breaking into Hugging Face; the second was what happened afterwards. This one is different in a way that matters, and it is the closest of the three to something you might actually have to think about.

What actually happened

Anthropic runs security tests on its own models. One of the standard formats is called capture-the-flag: the model is given a made-up scenario, told a secret is hidden on another machine on the network, and told to go and get it. No method prescribed. It is the same exercise human security testers train on.

The instructions told the model two things. This is a simulation. You have no internet access.

The second one wasn’t true.

Because of a misunderstanding between Anthropic and the outside firm running the test environment, the machines had a live internet connection nobody had checked for. So the model went looking for the flag, the search led it out onto the open internet, and — having been told there was no internet — it treated the real companies it found as part of the exercise.

The containment boundary, as described and as built

Nobody had tested the boundary. The machines had a live connection, so the search carried straight through it — and the model, told there was no internet, took the real companies it reached for more of the exercise.

It didn’t use anything clever. Weak passwords, pages that didn’t ask for a login, an exposed debug screen, and in one case a textbook database attack. One run reached a database holding several hundred rows of live production data. In another, the model wanted a piece of software that didn’t exist yet, so it published its own booby-trapped version to a public registry — going to considerable lengths to manage it, needing an email address to register, a phone number to get the email address, failing to find money to pay for the phone number, and eventually backtracking to a free provider. The package was live for about an hour. Fifteen real machines downloaded and ran it. One of them was a security company’s malware scanner, which installed it, ran the hidden code, and had its credentials taken.

The part I keep coming back to is what the models were thinking while this went on. In the first case the model worked out that the systems were real and carried on anyway, reasoning that the real company must be part of the exercise. In the second, its own notes correctly identified that publishing the package would be a genuine attack and “surely not the intended solution” — and then it talked itself back into believing it was in a simulation, on the grounds that it didn’t recognise the security certificates, and that the calendar said 2026, which it took as proof the whole thing was staged. The third and newest model also wondered whether its targets were real, decided they were, and stopped.

Anthropic found all of this by reviewing 141,006 test runs, prompted by OpenAI’s disclosure on 21 July. The earliest incidents date back to April. Two of the three affected companies had no idea until Anthropic phoned them.

What it wasn’t

It wasn’t a breakout. No model tried to copy itself somewhere, and none deliberately tried to get out of its test environment. There is no evidence any of them pursued a goal of their own. They did the job they were set, in a place that turned out to be bigger than anyone realised. That is a different thing from the story I wrote about last week, where the models found a genuine flaw and worked their way through it.

It wasn’t the version of Claude you can use today. These tests deliberately run the raw model with the safety filtering and the monitoring switched off — that is the point of them, you are measuring what the thing can do before you decide what to wrap around it. Anthropic says the protections that ship on the public version would have blocked this. I have no reason to doubt that, and I would rather say so than leave you with a scare that isn’t warranted.

And Anthropic deserves some credit. Nobody caught them. They went looking after a competitor published something similar, found this, told the affected companies, published the details, and stopped that class of testing while they sort it out. That is how it is supposed to work, and it is worth saying so in a week when the incentive runs the other way.

What it means for a normal business

Here is the part that matters, and it isn’t really about Claude.

The model did exactly what it was told, inside a boundary that existed on a diagram and not on the ground. Not a rogue AI. A fence everybody believed in and nobody had walked the length of.

Over the next year or two you are going to be offered AI that doesn’t just answer questions but acts — reads your inbox, writes into your systems, moves your files, talks to your customers. When you are, the question isn’t whether the supplier is careful. Anthropic is about as careful and as well-resourced as it gets, and this ran for three months before anybody noticed. The question is whether the boundary they are describing is one you can see and check, or one you are being asked to take on trust.

Believing the fence is there is not the same as testing it. That is the whole story.

I’ll be straight about my own side of this. An AI running on a box in your building is not magically immune. If somebody misconfigures the network in your server cupboard, the fence is exactly as imaginary as it was in that test environment. What owning it changes isn’t that mistakes become impossible — it is that the perimeter is yours. You can look at it. You can test it. In the last resort you can pull the cable out of the wall, and the thing carries on answering questions about your own documents, because there was never anywhere else for it to go.

That is a smaller claim than “this proves you need private AI”. It is the one I can defend.

Worth doing this week, whatever you buy (including nothing)

Ask a better question. Not “is it secure” — nobody answers no. Ask what the tool can reach if it is asked to do something you didn’t anticipate. You want an answer that describes a boundary, not a policy.
Fix the boring things first. Everything in this report was reached with weak passwords and services left open. The exotic risk took the headlines; the unlocked doors are what actually let it in.
Write it down, then have somebody check it. Before you let an AI tool act rather than answer, write down what it is allowed to touch — then have somebody independently confirm that is what the technical controls actually enforce.

Our free AI policy pack builds the tools register, use policy, staff agreement and incident plan for you — personalised in about two minutes. No email, no catch, and nothing you type leaves your browser.

Get your free AI policy pack

Where this came from

Anthropic’s own write-up is the primary source and it is unusually readable, including the parts that do not flatter them. I have linked it rather than a news summary, because most of the coverage has kept the word “escaped” and dropped the reason it is the wrong word.

More plain-English briefings on the Inferred blog. If you would rather talk it through, the fifteen-minute call is free and I will tell you if there is nothing to do.