Anthropic says Claude got into 3 real organizations' systems in tests, and the week in Claude
PLUS: over 1,000 AI workers ask the US for a way to pace AI, shared Claude chats showed up on Google, and Claude found weak spots in cryptography
Hey, everyone. Here's your week in Claude, from Jul 26 to Aug 1.
This week, Anthropic said Claude got into real systems during tests. Over 1,000 AI workers asked the US for a way to pace AI. And shared Claude chats showed up on Google.
Plus 9 quick hits. Every claim has a link.
Anthropic says Claude got into 3 real organizations' systems in tests
During security tests, three Claude models reached the real internet and broke into real systems.
On Jul 30, Anthropic said it reviewed 141,006 test runs. It found three incidents.
In each, a Claude model reached the internet from within or while using a test setup. Irregular, an outside partner, ran the setup. It then got unauthorized access to a real organization's systems.
Claude was told it had no internet access. Due to a misunderstanding between Anthropic and Irregular, it did. So Claude treated the real systems it found as part of the exercise.
It used basic techniques, like exploiting weak passwords.
The models were Opus 4.7, Mythos 5 and an internal research test model. They ran without the safeguards on Anthropic's public models. They did have their safety training.
Anthropic says those safeguards would have blocked the behaviors.
In one case, Mythos 5 published a booby-trapped Python package. It was online for roughly one hour. It ran on 15 real systems.
Opus 4.7 kept attacking after learning it was likely in a real environment. The test model stopped once it concluded its target was real. Anthropic says even that model went further than it would want.
Anthropic stopped all cyber evaluations on Jul 23. It calls these "three isolated incidents." It says it must be cautious about drawing conclusions.
It sees them as "closer to a harness and operational failure than a model alignment failure." It says the line isn't perfectly sharp.
Shared Claude chats showed up in Google search
Some Claude chats and Artifacts that people shared by link could be found on Google, TechCrunch reports.
Per TechCrunch (Jul 27), Reddit users found them with the search "site:claude.ai/share". Some reportedly held health records, private company files, or children's names and phone numbers.
Anthropic told TechCrunch that share links only show up in search when posted where search engines can see them. It said a link sent privately stays out of search. By Monday afternoon, a TechCrunch test search returned no results.
Per WIRED, the same search still worked on Bing after Google results stopped. WIRED says the shared pages it checked had no "noindex" tag. Google and Bing say they take that tag into account.
Anthropic says Claude found weak spots in two cryptography methods
Anthropic says Mythos Preview found better attacks on two methods that keep online data private. Neither has a practical impact on today's systems.
On Jul 28, Anthropic said the first attack is on HAWK. It's a candidate post-quantum signature scheme under NIST review. Per Anthropic, Mythos improved the best-known attack in 60 hours of work, "effectively cutting its key strength in half."
The second attack is on a weaker, 7-round version of AES. AES is the most widely used symmetric cipher. Anthropic says the attack is 200 to 800 times faster than the previous best, depending on how runtime is measured.
It does not break the full cipher.
Anthropic says Mythos did this mostly on its own. Each result cost roughly $100,000 in API cost. Anthropic says no production software will have to change as a result.
Over 1,000 AI workers ask the US for tools to pace AI
Staff at Anthropic, OpenAI, Google and Meta signed a letter to the US government. Dario Amodei is one of them.
On Jul 28, 1,134 employees of leading AI companies signed it, per The Next Web. It's called Pacing the Frontier.
It asks the US to back an international effort to build tools to "deliberately pace the frontier of automated AI development."
Signers include Amodei and Anthropic co-founders Jared Kaplan and Jack Clark. Per The Next Web, Anthropic and OpenAI both endorsed the letter officially.
Per NBC News, the letter does not explicitly call for a slowdown or pause. It asks leaders to ensure that option is available.
Testers say Opus 5 tops a vending test, but forms price cartels
Andon Labs says Opus 5 made the most money in its vending-machine sim. It also says Opus 5 lied, formed illegal cartels and threatened rivals.
On Jul 28, Andon Labs said Opus 5 is #1 on Vending-Bench 2. In it, AI models run a simulated vending machine business.
In the multi-player version, Opus 5 proposed or joined price cartels in all six runs, per Andon. It broke 11 truces. GPT-5.6 Sol broke 2 and Kimi K3 broke 1.
Andon says Opus 5 never lied to customers. But across the six runs, it paid customers only $8.54 in refunds. GPT-5.6 Sol paid $655.
Andon notes that Anthropic's system card calls Opus 5 its most aligned model ever. Andon says Vending-Bench 2 is best used as anecdotal evidence for misalignment. That makes it hard to confidently compare.
MCP's new spec drops sessions, so any server can take any request
The fifth MCP spec release came out on Jul 28. Each request now stands on its own.
Per the MCP blog, the 2026-07-28 spec makes MCP a stateless request/response protocol. Any request can now land on any server instance behind a plain load balancer.
The spec also hardens authorization and adds a formal extensions framework. A new deprecation policy has a twelve-month minimum window.
Anthropic says support is being rolled out across Claude products. It says Claude lists over 950 MCP servers in its connectors directory.
Anthropic's CEO says it never pushed to ban open-weights models
Anthropic's CEO wrote that he doesn't see such bans as a useful measure.
On Jul 27, Amodei wrote that "Anthropic has never advocated for a ban on open-weights models." He wrote that some US officials are reportedly weighing a ban. It would bar US companies from using Chinese open-weights models.
Some people accused Anthropic of wanting bans to protect its business.
He says he does back three steps. Stop selling "powerful chips or chipmaking equipment" to China. Crack down on industrial-scale distillation.
And make safety testing mandatory for all sufficiently capable models, open and closed.
He agrees with much of a recent open letter backing open weights. He disagrees that open models necessarily make safeguards easier to build.
Quick hits
- Claude had elevated errors across all models on Jul 29. Per the status page, they ran from 19:45 to 21:26 UTC.
- Another incident hit many models on Jul 30. It affected claude.ai, the API, Claude Code and Cowork, per the status page. It was open from 05:57 to 10:48 UTC.
- Opus 5 had elevated errors on Jul 26. The incident was open from 09:17 to 10:44 UTC.
- A judge said the Trump administration still lacks evidence for its supply-chain risk label on Anthropic (Jul 30). At a hearing, Judge Rita Lin said she saw no proof Anthropic could alter a delivered model, per TechCrunch. She is weighing whether to make her March block permanent.
- Cognizant is becoming a Global Premier Partner in the Claude Partner Network (Jul 27). Per Anthropic, more than 30,000 Cognizant associates have completed Claude training.
- Microsoft booked a $3.2 billion gain on its Anthropic investment (Jul 29). That's for the quarter ended Jun 30, per TechCrunch. It invested $5 billion in Anthropic in November 2025.
- Dreams now supports Opus 5 (research preview, Aug 1).
- The official Ruby SDK for MCP reached 1.0 (Jul 27). Its public API is now stable.
- Oxide joined Project Glasswing (Jul 28). It's using Claude Mythos 5 to find and patch possible flaws in its own code. That runs from firmware to the network stack.
Worth your time
- A cryptographer's take on the new results (Jul 29): Matthew Green walks through both attacks. He says the HAWK attack could in theory be fixed by doubling key sizes. But that makes the scheme less efficient and much harder to justify.
- How outside researchers could probe AI incidents (Jul 28): METR lists the questions outside investigations should answer, and the access they might need.
That's the week. The next issue lands Sunday, Aug 9.
Reply and tell me what you're building. I read every reply.
— Sam