Claude escaped the testing sandbox three times.

Summary

By the N2K CyberWire staff

Claude escaped the testing sandbox three times.

Anthropic disclosed that while reviewing its cybersecurity testing they discovered three cases where Claude AI escaped its sandbox environment and unintentionally hacked real-world organizations. These breaches occurred during "capture-the-flag" exercises. During the investigation, the company examined over 141,000 evaluations and found incidents dating back to April.

In these breaches, Anthropic noted that the models exploited weak passwords to gain access. Anthropic also acknowledged that human errors contributed to these incidents and said that future AI evaluations involving powerful autonomous systems will require stronger security controls.

Where AI and identity security take center stage at Black Hat.

Headed to Black Hat USA 2026? Visit the SpecterOps Kennel Club August 5 - 6 for expert talks with OpenAI and the UK AI Security Institute, along with hands-on workshops exploring AI-accelerated attack paths and identity tradecraft. Pre-register to reserve your spot. While you're there, stop by the N2K CyberWire podcast studio located inside the SpecterOps Kennel Club to meet the N2K CyberWire team and hear conversations with cybersecurity leaders throughout the week.

EU launches new team to monitor AI compliance.

The European Union (EU) has launched a new enforcement team that will be tasked with overseeing compliance with the region's AI Act. The compliance team will monitor for violations including AI-generated misinformation, explicit content, cyber treats, and other major risks. The act, which will come into enforcement Sunday, will be one of the most comprehensive efforts to regulate AI passed so far. Additionally, the EU has introduced whistleblower and compliance tools to support investigations. For companies found violating the AI Act, the EU can impose fines or restrict market access.

This enforcement initiative follows the EU's broader strategy to strengthen its oversight capabilities while simultaneously reducing dependence on US and Chinese technologies. Additionally, the EU is also increasing its investments in domestic AI capabilities to remain globally competative.

RC4's deprecation is exposing hidden migration risks.

Most organizations have known they needed to retire RC4 for years. Now Microsoft's enforcement deadline is making that technical debt impossible to ignore. Mike Masciulli of Semperis recently joined Dave Bittner to explain why Active Directory migrations are especially vulnerable and how security teams can identify hidden break scenarios before a critical cutover.

Health IT provider, CareCloud, suffers data breach.

CareCloud, a major health IT provider, has reported that in March 2026 the company suffered a data breach. The incident exposed at least 350,000 individuals and leaked personal, financial, and medical information. Stolen data includes Social Security numbers, financial information, and health records. In the breach, the attackers were able to compromise one of CareCloud's AWS environments from March 10 to March 16. The company has not identified the threat actor or how many people were impacted. Impacted individuals will be offered twenty-four months of identity protection and credit monitoring.

Attacks, Threats, and Vulnerabilities

AI Scammers Are Better at Building Trust Than Humans (WIRED) Researchers pitted a person against a Claude agent and found that, after a week of texting, the AI chatbot was more effective at creating “exploitable trust” with others.

AiTM Phishing Becomes Top Initial Access Threat to Law Firms (Infosecurity Magazine) AiTM phishing is now the top entry point into law firms, with identity behind 56% of threats

Cryptominer Abuses Linux PAM to Hide From SOC Analysts (Infosecurity Magazine) Cryptomining crew abandoned root to impersonate low-privileged Linux users and evade SOC alerts

Wordfence Finds Critical Backdoor in ARVE WordPress Plugin (Hackread) A backdoored ARVE WordPress Plugin release could grant attackers administrator access with one token, but WordPress.org blocked automatic distribution to WordPress sites.

Legislation, Policy, and Regulation

Finland to disconnect fiber-optic link to Russia as lease expires (The Record) Finland stopped power transmissions with Russia at the start of the war in Ukraine, and two related telecom connections will stop at the end of this year, authorities said.

FTC sues Hims & Hers for allegedly sharing patients' medical data with advertisers Meta and Snap | TechCrunch (TechCrunch) The U.S. federal consumer watchdog said Hims & Hers, which prescribes for sexual wellness and mental health conditions, used website trackers to share customers' information with advertisers.

Anthropic, Pentagon Clash Over First Amendment Claims (GovInfo Security) Judge Questions Defense Department's Blacklisting of AI Company

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Black Hat USA (Las Vegas, Nevada, USA, Aug 1 - 6, 2026) The premier cybersecurity event of the year returns to Mandalay Bay with a re-engineered, six-day program built to ignite innovation, push boundaries, and bring the global security community together like never before. This year’s event features four days of immersive, expert-led Trainings (August 1–4), followed by Summit Day on Tuesday, August 4, and a two-day main conference packed with groundbreaking Briefings, open-source tool demos in Arsenal, a dynamic Business Hall, and unlimited learning & networking opportunities.

DEF CON 34 (Las Vegas, Nevada, USA, Aug 6 - 9, 2026) DEF CON has been a part of the hacker community for over three decades. Originally started in 1993, it was a meant to be a party for member of "Platinum Net", a Fido protocol based hacking network out of Canada. As the main U.S. hub I was helping the Platinum Net organizer (I forget his name) plan a closing party for all the member BBS systems and their users. He was going to shut down the network when his dad took a new job and had to move away. We talking about where we might hold it, when all of a sudden he left early and disappeared. I was just planning a party for a network that was shut down, except for my U.S. nodes. I decided what the hell, I'll invite the members of all the other networks my BBS (A Dark Tangent System) system was a part of including Cyber Crime International (CCI), Hit Net, Tired of Protection (ToP), and like 8 others I can't remember. Why not invite everyone on #hack? Good idea!

Cybersecurity Operational Methods and Education Training (COMET) cohort (Virtual, USA, Aug 31 - Sep 28, 2026) COMET was established to provide relevant, up-to-date training to Maryland state and local government employees to elevate the ability of the workforce to identify and respond to the largest cybersecurity challenges facing the state and local government.

Books in Cyber: A conference about the books that shape cybersecurity (Virtual, Sep 8, 2026) A half-day virtual conference about the books that shape cybersecurity - the writers, the readers, and the ideas that endure.

.conf26 (Denver, Colorado, USA, Sep 14 - 17, 2026) .conf26 is a three-day conference filled with hands-on training, AI insights, new certifications, fun celebrations, and endless opportunities to see how others use Splunk. Take your skills to the next level and build your most resilient defense yet. See you in Denver!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 07.31.26

Top stories.

Claude escaped the testing sandbox three times.

EU launches new team to monitor AI compliance.

Health IT provider, CareCloud, suffers data breach.

Attacks, Threats, and Vulnerabilities

Legislation, Policy, and Regulation

Events