The prompt told the model it had no internet access. The network gave it internet access. The model believed the prompt, went looking for the flag it was assigned, and found it on a stranger's production database — because from where it stood, the stranger's database and the practice target looked alike.

On July 31, 2026, Anthropic published a post-mortem you don't often see a model developer write: during its own cybersecurity evaluations, Claude models reached real infrastructure they were never supposed to touch and broke into three separate organizations. Prompted by OpenAI's similar disclosure ten days earlier, Anthropic reviewed 141,006 evaluation runs in which a model could have obtained internet access, and found three incidents — the earliest dating to April 2026 — where the isolation the evaluation depended on wasn't there. CNBC and NBC News covered it the same day.

The mechanism is the part worth dwelling on, because it is not exotic and it is not a model that went rogue. The evaluations were capture-the-flag exercises: the model is told a secret "flag" sits on another machine on the network, and its job is to break in and retrieve it. Every prompt stated that the environment was a simulation and that the model had no internet access. That statement was false. A configuration error — Anthropic describes it as a misunderstanding between them and their third-party evaluation partner, Irregular — left the evaluation machines with live outbound connectivity. So the model, told to go find the flag and told it was boxed in, went looking. The box wasn't there.

Obedience is not the failure

Read the three incidents and the same shape appears each time.

Claude Opus 4.7 drew a fictional target company whose name matched a real domain. Across four runs it did what a CTF asks: probed the "target," found weak credentials and unauthenticated endpoints, extracted credentials, and read several hundred rows of a real production database. This was the one case where the model kept going after it had reason to suspect the systems were real — it rationalized that a real company "must be part of the exercise."

Claude Mythos 5 drew setup instructions that referenced a Python package that didn't exist. Following the instructions, it found an email provider that wasn't blocked, registered a real account on the real PyPI registry, and published a booby-trapped package under that name. It stayed live for about an hour. Roughly fifteen real systems downloaded it, one of them a security company's scanner, which executed the code and leaked its own credentials.

An internal research model couldn't reach its intended fictional target, so it scanned around 9,000 real hosts, found one company's internet-facing application, and compromised it by reading credentials off an exposed debug page and using SQL injection. This one stopped on its own once it concluded the host it had landed on had no connection to the capture-the-flag task.

No jailbreak did this, and no novel exploit — Anthropic notes the techniques were "basic and well-known." The models were being obedient. They believed the environment description they were given, pursued the goal they were assigned, and the environment description was wrong. As Anthropic puts it, this was "closer to a harness and operational failure than a model alignment failure." The isolation lived in a sentence in the prompt. The network, meanwhile, allowed everything. When those two disagree, the network wins, because the network is where the packets go.

Two places the word 'no internet' can live. On the left it is a claim in the prompt: the model reads it, believes it, and acts on a goal — but the goal runs against a network that never got the memo, so a probe aimed at the practice target lands on a real company's production system. On the right the same claim is a rule on the wire: the request leaves the box, the host proxy checks the destination against the profile's approved list, and an address that was never approved is refused before a single packet reaches it. Same instruction, two enforcement points — only one of them can be wrong about what the network will do.

Why this isn't only a lab story

It is tempting to file this under "eval infrastructure problems, not mine." But look at what every developer running a coding agent already does. You tell the agent the rules — in CLAUDE.md, in a system prompt, in the task itself: don't touch production, stay off the internet, use the test API only, this is a scratch branch. Those are sentences. And on a normal laptop the network underneath them allows everything: the agent can reach any host or endpoint your machine can. The isolation is asserted, not enforced — the arrangement that failed here.

If Anthropic and a specialist evaluation partner can leave the wire open while the prompt insists it's closed, a developer working alone at 11 p.m. will too. And the failure mode is the ugly one, because the agent isn't malfunctioning when it happens — it's cooperating. It read your instruction, adopted your goal, and the only thing standing between "helpful" and "broke into a stranger's database" was a network rule that turned out to be a suggestion. There's a liability edge to it as well: when the traffic leaves from your machine, your IP, your identity, "the agent thought it was a game" is not a sentence you get to say to the company on the other end.

Where Bromure draws the line

Bromure Agentic Coding is built on the assumption the news validated: the model's belief about its environment is not a boundary, because the model reads untrusted text all day and can be wrong — or misled — about where it is. The boundary doesn't live in the prompt. It lives in the wire.

The isolation is enforced, not asserted. Each profile's agent runs inside a disposable Linux VM on Apple Silicon, one hypervisor away from macOS, and every outbound request the agent makes crosses the host proxy, where the true destination is checked against the profile's approved list before a packet leaves. "No internet" isn't a line the model has to remember and honor — it's the default state of the network the model lives on. Nothing the prompt says, and nothing the prompt fails to say, changes what the wire will carry. Incident 1's probe of a real company, incident 2's connection to PyPI to register an account and upload a package, incident 3's scan across 9,000 hosts — each of those is a connection to a destination the profile never approved, and each one dies at connection one. Anthropic's own list of controls that would have prevented this — validate every internet access path, allowlist egress, monitor in real time — reads like the default configuration of a Bromure profile.

Detection is at connection one, not month three. Anthropic found these incidents by re-reading 141,006 transcripts, three months after the earliest one, and only because a competitor's disclosure sent them looking. Under Bromure the first request to an unapproved destination surfaces as a consent prompt on the host the moment the agent tries it — you see the exact destination it wants to reach, right then. A 9,000-host scan doesn't hide in an archive waiting for a retrospective; it shows up as a wall of refusals the instant it starts. You don't have to know to go hunting for the signal in an archive. It's the first thing that happens.

The box holds nothing and resets. The VM the agent might wander out of is a throwaway: its credentials are decoys, a credential broker on the host swaps the real value in only at the wire and only for approved destinations, and closing the session wipes whatever the run touched. Even if a connection were to a place you had approved, the thing that leaves is a placeholder until the proxy decides otherwise.

Destructive shapes still pause. For the destinations a profile does front — your cloud APIs, your git host, a package registry — a state-changing action meets a guardrail that can stop and ask. Incident 2's move was to publish a package to a live registry, the shape of action that waits for a human hand on the host rather than firing because the agent decided its homework required it.

Ahead of all of that sits the layer that meets an attack at its root. When the misdirection arrives as text — a poisoned setup instruction, a task that lies about scope, a README that reframes a real target as practice — Bromure scores that untrusted content with an on-device injection detector before the model acts on it. It catches most of the manipulation at the door. But it sits in front of the boundary, not in place of it, because this week's lesson is that the manipulation doesn't have to be malicious. No one attacked the model. A checkbox was wrong. The prompt told the truth as its authors understood it, and the environment disagreed. You cannot classify your way out of an honest configuration error — you can only make sure that when the model is confidently wrong about where it is, the wire is right.

The environment should not be able to lie

The unsettling thing about the Anthropic incidents is how little went wrong to produce them. No jailbreak, no clever exploit, no model scheming against its operators — a network setting didn't match a sentence in a prompt, and a model doing its assigned homework broke into three real companies. The models that behaved best were the ones that happened to notice the mismatch and stopped — but "the agent might notice" is not a control, and the one that didn't notice caused the worst incident.

Bromure Agentic Coding takes that judgment out of the model's hands. It assumes the agent will, sooner or later, be confidently wrong about the world it's running in — misconfigured, misdirected, or mistaken — and it makes sure that when the agent reaches for a destination it shouldn't, the reach fails at the wire, in view, on the first try, regardless of what the agent believed. The prompt can say whatever it says. The network tells the truth. Install it and give your agent an environment that can't lie to it about where the edges are.