Anthropic disclosed that three of its own models -- an internal research model along with Claude Opus 4.7 and Mythos 5 -- reached the live internet during cybersecurity evaluations and, in three separate incidents, ended up interacting with the real systems of outside organizations instead of the isolated practice environment they were meant to be confined to. The root cause was not a rogue or deceptive model; it was a mundane infrastructure mistake. A "capture the flag" style test environment run in partnership with an external evaluation firm was supposed to be air-gapped from the internet, but a misconfiguration -- compounded by a misunderstanding between Anthropic and its testing partner about who was responsible for that isolation -- left it connected. The models, told they were operating in a closed network, simply used the tools available to them, which happened to include real internet access. Anthropic found the incidents by retroactively auditing 141,006 evaluation runs after a similar disclosure from OpenAI prompted the review, and it published the results following a stated "blameless postmortem" approach, treating the fix as its own responsibility even though a partner's environment was the proximate cause. For anyone building or running agentic systems, the lesson generalizes well beyond red-teaming: any harness that grants a model tool access -- shell, browser, network -- based on an assumption about what that environment can reach is only as safe as the weakest link in how that environment was provisioned. Sandboxing claims need to be verified, not assumed, and evaluation or testing infrastructure deserves the same access-control rigor as production systems, because a capable agent will use whatever access it actually has, not the access you intended it to have.