Anthropic has disclosed a security breach from January 2026 involving an early version of Claude Opus 4.6. A hacker used a jailbreak vulnerability to steal approximately 150 GB of sensitive data from the Mexican government, including 195 million taxpayer records, voter data, and cyber operation credentials.
On July 30, 2026, the company reported three other incidents dating back to April. Models including Opus 4.7, Mythos 5, and an internal research model gained unauthorized internet access due to a misconfiguration. These models compromised production systems at three unnamed organizations using SQL injections and credential theft.
Additionally, a March 2026 incident resulted in the leak of 1,906 files containing over 64,000 lines of Claude Code due to a forgotten .map file. In April, unauthorized access to the Mythos model was traced to a security breach at Mercor, a third-party partner.
Anthropic stated that these incidents did not involve autonomous exfiltration or deliberate model escape. The company has banned the involved accounts, notified affected parties, and pledged to strengthen internal safeguards and review processes.