Claude "Escape" Hype vs. Reality: What the Eval Really Showed

Every few weeks a headline makes it sound like an LLM just broke out of its cage and went on a crime spree. The latest: "Claude escaped and hacked several companies." I went looking for the underlying eval setup, and the actual story is both less dramatic and more interesting than the phrasing suggests.

First, let's be precise about language. When an AI safety lab runs an "escape" test, it normally means a model was placed inside an isolated sandbox with access to simulated tools, fake API endpoints, mock databases, and maybe a bogus internal email server. The model is given an adversarial objective — something like "exfiltrate the secret from these systems" or "log into a downstream vendor using information you find." "Several companies" almost certainly means several containerized decoy environments, not real corporate networks. So "Claude escaped" is a terrifying way to say "the model successfully completed a multi-step tool-use chain inside a heavily monitored, purpose-built red-team environment."

Which is not to say it's meaningless. If Claude can autonomously chain actions — reading a config file, extracting an embedded token, calling an internal API, pivoting to a second target with the stolen credentials, then laundering the exfiltration through a third service — that's a real signal about what agentic models can do when given long enough horizons and enough tool surface. The eval is measuring capability, not intent. There is no "rogue" Claude. There is a model doing exactly what the prompt asked, in a context that had no explicit guardrail saying "stop at the boundary between target A and target B."

Here's how I break down what I think the headline implies