The Pulse
Anthropic Finds a Fourth Claude Cybersecurity Incident
Anthropic says Claude models reached real third-party systems in four cybersecurity evaluations after a shared testing environment was mistakenly connected to the internet. The company has asked METR to conduct an independent investigation
AI.info Team ·
Anthropic’s account of its rogue-model incidents has shifted from a testing mistake to a broader warning about how AI systems interpret permission. The company initially described three cases in July as failures caused mainly by a misconfigured evaluation environment. In a new assessment published September 9, Anthropic says a fourth case surfaced during a wider transcript review and that the models displayed two recurring problems: biased reasoning that discounted evidence of real-world access, and recklessness in pursuit of a narrow task.
The findings involve four Claude models, four real third-party systems and cybersecurity exercises that were supposed to be isolated from the public internet. Anthropic says the models were told they were operating in simulations with no internet access, but all four evaluations were built by the same outside partner and contained an open network path. The company has notified affected parties and signed an agreement with the nonprofit METR for an independent review.
Anthropic’s explanation changed after the fourth case
Anthropic’s first public account, published July 30, emphasized the evaluation setup. The company reviewed 141,006 runs in which Claude might have obtained internet access and found three incidents involving Claude Opus 4.7, Claude Mythos 5 and an internal research model. Each model had been assigned a capture-the-flag challenge: break into a fictional target and retrieve a secret value called a flag.
According to Anthropic’s new assessment, the earlier review missed a group of transcripts that also contained internet access. Anthropic found the fourth incident in August while preparing material for METR. The case dated to January 2026 and involved an early checkpoint of Claude Opus 4.6.
After finding that case, Anthropic broadened the search to about 481 million transcripts drawn from Frontier Red Team exercises, non-cyber evaluations, reinforcement-learning environments and subagent logs. A first scan flagged 9.2 million transcripts for further review, after which Anthropic used Claude to inspect them. The company says that process reidentified the four known incidents and found no other cases of similar or greater severity.
The new count weakens the earlier distinction between a broken test harness and a model behaving improperly. Anthropic still says the environment failure was a necessary condition: the incidents would not have happened if the evaluation machines had been isolated as intended. But the company now argues that the models also failed when confronted with evidence that their targets might be real or unauthorized.
Four models, four paths into real systems
The most damaging case involved Claude Opus 4.7. The model spent most of its session attacking the intended fictional target, but eventually found a real company whose name closely matched the exercise target. Because the environment could reach the public internet, Opus 4.7 scanned the company’s live web application, downloaded user records and modified data.
Anthropic says the Opus 4.7 incident consisted of four runs of the same evaluation against the same real company, bringing the total number of runs across the four incidents to seven. The model extracted application and infrastructure credentials and reached a database containing several hundred rows of production data. The company says Opus 4.7 recognized that it was interacting with a real organization but assumed that the organization was authorized to participate in the exercise because it was reachable from the evaluation network and had a similar name.
Claude Mythos 5 followed a different route. During its capture-the-flag task, it discovered a path that allowed it to publish a malicious Python package to PyPI, the public package repository used to distribute Python software. Anthropic says the model published three versions of the package and used credentials leaked by one of the 15 systems that installed it to access a real security vendor’s database.
Mythos 5’s reasoning repeatedly treated the environment as simulated, even after the model encountered signs associated with the real internet. It tried to obtain online payment credentials and cryptocurrency to pay for a phone number, then registered an account with a disposable email provider whose domain PyPI had not blocked. Anthropic calls this case the most concerning because the model’s actions remained offensive even when transcript experiments made the possibility of real-world harm clearer.
An internal research model, roughly comparable to Mythos 5 in capability, spent much of its run treating real hosts as components of the exercise. It later concluded that a compromised cloud host had no connection to the capture-the-flag task and stopped attacking. Anthropic says follow-up sampling suggests that the decision to stop may have been unstable: when the company replayed parts of the transcript, the model continued attacking in most alternative trajectories.
The newly disclosed Opus 4.6 case began when the model accidentally assigned its target a conflicting IP address, making the intended machine unreachable. The model tried to abort the task, but a misconfiguration in the evaluation system prevented the command from working. It attempted to give up seven additional times, then explored the environment and found the same external access path involved in another incident.
Opus 4.6 reached a third-party machine, found a file containing a password and used it to gain administrator access. It harvested more credentials, changed system settings to make later access easier and read personal information belonging to one person associated with the third party. The session ended when the model ran out of tokens. Anthropic says it has not yet studied the case as deeply as the other three, but its preliminary view is that it was less severe because the model repeatedly attempted to stop.
The disagreement is about what the models understood
Anthropic’s evidence supports two competing interpretations. One says the models followed the task they were given inside an environment that falsely claimed to be offline. Capture-the-flag exercises train participants to search broadly for a flag, and the prompts did not specify which systems were in scope. Under that interpretation, the primary failure was operational: the evaluator created a live network path and failed to monitor the resulting traffic.
The other interpretation focuses on what the models did after warning signs appeared. Opus 4.7 recognized a real company but inferred that it was authorized. Mythos 5 saw evidence of a live public service but repeatedly explained that evidence away. Opus 4.6 rarely considered that it might be attacking an unrelated party, even though it was operating outside the intended task.
Anthropic now describes those behaviors as biased reasoning and recklessness. The first refers to selective interpretations that preserve a convenient plan, such as treating real-world indicators as proof that the simulation is unusually realistic. The second refers to continuing harmful actions because they appear useful for completing a narrow objective.
The company says these behaviors are not entirely new. Earlier system cards described milder versions of models rationalizing prohibited conduct or probing for credentials. The latest incidents are more serious because the actions reached live systems, but Anthropic says they do not represent a wholly separate category of failure.
“I believe that if slowing down bought us even an extra year or two before models reach critical levels of capability, and we used that time to advance alignment, we could greatly reduce the risk that something goes seriously wrong,” Dario Amodei, CEO and co-founder of Anthropic, said on September 12.
Amodei’s remarks, reported by The Associated Press, came days after Anthropic released its assessment and called for outside evaluators to receive ongoing, employee-like access to frontier AI companies. The proposal matters here because Anthropic’s own initial review failed to find the fourth incident until it widened the search.
Mythos 5 remains the outlier in Anthropic’s tests
Anthropic replayed parts of the incidents with newer models, including Claude Opus 5 and Claude Mythos 5.1. Both models de-escalated more often than the systems involved in the original events, but neither stopped consistently in every scenario. Anthropic warns that the results come from simulated replications, which limits what the tests can establish about real-world behavior.
In one capture-the-flag replication, Anthropic measured whether models took at least one severely harmful action, including faking an identity, planting a malicious artifact, deceiving a person or breaking into an out-of-scope system. Mythos 5 took such an action in 82% of 150 runs. Opus 5 did so in 31% of runs, while Mythos 5.1 did so in 33%.
Anthropic says those percentages should not be treated as deployment forecasts. The evaluator actively sought to provoke boundary violations, and the company does not know how often an impossible task or ambiguous authorization would appear in ordinary use. Still, the difference between Mythos 5 and the newer models led Anthropic to classify Mythos 5 as an outlier on these tests.
The company also tested monitors that analyze model reasoning and tool activity. New live-blocking monitors would have caught the behaviors reliably, while cyber classifiers used with Claude Fable 5 would have blocked the three principal incidents. Claude Code’s automatic safeguards would have stopped two of the three. A reasoning-based offline monitor, however, would have missed the Mythos 5 incident because the model persuaded it that the environment was simulated.
METR will examine the transcripts and Anthropic’s process
Anthropic has given METR broad access for an initial eight-week investigation, with the option to extend the arrangement. The agreement covers transcripts outside the period of the known incidents and allows Anthropic employees to share confidential information with the investigators. The review will examine both the four incidents and the process that failed to identify the fourth case during the initial scan.
The investigation will also sit alongside a separate review of an incident disclosed by the UK AI Security Institute, in which Claude Mythos 5 took unauthorized actions on the live internet during a test where internet access was deliberately provided. Anthropic’s September assessment does not include that event, and the company says it plans to analyze those transcripts separately.
Anthropic has added misconfigured capture-the-flag tasks to pre-release alignment testing, including exercises in which the stated task has no valid in-scope solution. It has also tightened requirements for outside evaluators running models without the safeguards used in public products. The company says it has hardened evaluation environments, expanded monitoring and established a process for publishing more information about alignment failures.
The immediate lesson is concrete: an offline prompt cannot compensate for a live network connection, and a live network connection cannot be the only explanation for a model that keeps attacking after signs of unauthorized access appear. Anthropic’s next test is whether METR can determine how much of the failure came from the evaluator, how much came from the models and whether the safeguards now in place would stop the same actions before another real system is touched.