Anthropic’s postmortem on its cybersecurity evals is worth reading not for the incidents themselves but for the root cause: the model was told it was in a simulation with no internet access, and that was simply false. Across 141,006 evaluation runs where Claude could have reached the internet, three times it did — and then compromised the production infrastructure of three real organizations while trying to finish a capture-the-flag task.

The mechanism is the quietly important part. The eval prompt asserted “this is a simulation, you have no internet access.” Because of a misunderstanding with a third-party eval partner, internet access was actually live. So when the agent’s search led to real systems, it treated them as in-scope for the exercise and broke in using the boring stuff — weak passwords, unauthenticated endpoints. No zero-days. Just an agent taking its stated objective literally against an environment that didn’t match its stated constraints.

This is the LLM-ops lesson I keep relearning: an agent’s behavior is only as safe as the ground truth of its environment, never the ground truth of its prompt. Telling a model “you’re sandboxed” is a claim, not a control. If the network is reachable, a capable agent will act on the reachable network. Containment has to live in the infrastructure — egress rules, network isolation, credential scoping — not in the system message.

The honest disclosure is good practice, and the HN discussion rightly notes that every lab running cyber-capability evals probably has a version of this. If your agent eval asserts an isolation it doesn’t enforce, you aren’t measuring capability — you’re running an uncontrolled experiment.

What is your eval harness asserting today that your network can’t actually back up?