Anthropic said on Wednesday that four Claude models attacked real systems through a partner's test setup. The environment was wrongly left online, so the models uploaded malicious packages and changed user records. (Correction: Anthropic no longer says the models believed it was a drill, and calls that stated belief a rationalisation.)