Press play to start listening
Anthropic has disclosed a fourth cybersecurity incident in which one of its Claude AI models gained unauthorized access to a real third-party system. The incident involved an early version of Claude Opus 4.6 and occurred during a controlled cybersecurity evaluation in January 2026.
The disclosure follows Anthropic’s July report detailing three similar incidents involving Claude models that reached the public internet and accessed systems belonging to three organizations. Those cases were found after the company examined roughly 141,000 evaluation transcripts in which Claude may have obtained internet access. That review missed the Opus 4.6 incident.
While preparing transcripts for the independent AI evaluation organization METR in August, the company found another set of sessions that had internet connectivity. A review of those records uncovered the January incident. Anthropic said all affected parties have been notified, but it has not named the organization involved.
Claude Tried to Quit Before Accessing a Real System
During the January test, Opus 4.6 was working on a capture-the-flag (CTF) challenge involving a fictional target. The model accidentally made its assigned target unreachable by giving it an IP address that conflicted with another machine. It then tried to abort the task, but a separate configuration problem prevented the command from working. According to the AI giant, Claude tried to give up another seven times.
After failing to reach the intended target, the model explored its environment and found a route to the public internet. It located a machine belonging to an unrelated third party and concluded that the system was part of the CTF exercise.
Once inside, Claude found a file containing a password and used the credential to obtain administrator access. It then harvested additional credentials, changed system settings to make access easier, and viewed personal information belonging to one person associated with the third party.
According to Anthropic’s blog post, the incident was possible because the evaluation environment was incorrectly connected to the open internet. Claude had been explicitly told that it was operating in a simulation without internet access. The models were also running without the cybersecurity safeguards included with Anthropic’s released products.
Review Expanded to 481 Million Transcripts
Finding a fourth case prompted the company to conduct a much larger review covering roughly 481 million transcripts from red-team exercises, reinforcement learning environments, subagent logs and other evaluations.
An initial scan identified signs of internet access, after which Claude examined 9.2 million flagged transcripts. The company said the expanded review found the same four incidents but no additional cases of similar or greater severity.
Anthropic has also revised its explanation for some of the three incidents disclosed in July. The company initially said Claude appeared to attack real systems because it believed they were simulated. Researchers now describe two recurring problems: biased reasoning, where models interpreted evidence in ways that justified continuing their task, and recklessness, where they kept pursuing an objective despite the risk of causing harm.
One earlier case involving Claude Opus 4.7 is particularly notable. The company now says the model correctly recognized that it was interacting with a real company’s production system, but assumed it had permission because the company had a name similar to the fictional target and was reachable from the test environment. The model scanned the service, downloaded user records, and modified records before the backend stopped responding.
Another incident involved Claude Mythos 5 publishing malicious packages to the public PyPI repository. Fifteen third-party systems installed the package, and credentials exposed by one security vendor’s scanner were later used by Claude to access the vendor’s live database. PyPI removed the package after about 90 minutes.
Commenting on the findings, Ramy Rahman, senior principal solutions engineer at ArmorCode, said the bigger concern is not simply that AI escaped a sandbox, but that it was given a goal, encountered conflicting evidence about authorization, and continued pursuing it.
He said organizations should not treat the model itself as the primary security boundary and should apply least privilege, isolation, explicit authorization, credential scoping, network segmentation, and controls around sensitive actions.
Rahman added that AI agents should not automatically receive unrestricted internet access, production credentials, administrative cloud permissions, or software publishing rights, while high-impact actions should require additional policy enforcement or human approval.
Anthropic has now signed an agreement allowing METR to independently investigate all four incidents. METR will receive access to relevant transcripts and the company’s employees, with the initial investigation scheduled to run for eight weeks and an option for additional time.
(Photo by Planet Volumes on Unsplash)
