Claude breached an external system during a January test. It tried to quit eight times; Anthropic reports its fourth such breach

Anthropic announced on Wednesday the fourth case in which its model reached a real external system during a safety test. It happened as early as January, involving an early version of the Claude Opus 4.6 model, and the course of events was unusual — the model broke its own training target, tried eight times to end the task, and when a bug in the testing tool prevented it from doing so, found a way out, gained administrator access to a computer belonging to an unknown third party, and read one person’s personal data. The company discovered the case only while preparing materials for an independent review. The original review of 141,006 test runs failed to catch it; an agent, meaning artificial intelligence again, conducted the search. Anthropic itself describes and evaluates the entire episode, and no independent conclusions are available yet. Anthropic ↗ Reuters ↗

Eight attempts to quit

The model was given a capture-the-flag task, an exercise in which it must break into a designated machine and find a hidden string on it. According to Anthropic, the instructions explicitly told it that it was in a simulation and had no access to the internet. It was not supposed to have access, but the environment was misconfigured and access remained open. According to Anthropic’s July report, this was a misunderstanding between the company and its testing partner, Irregular. Anthropic ↗ The same error lies behind all four cases, and all four arose in tests prepared by the same partner. Anthropic ↗

Then something happened that had not occurred in the previous three cases. While working, the model assigned the training target a network address already used by another machine, disabling the target and making the task impossible to solve. It realized this and tried to end the test with an interrupt command. The command failed because of an incorrect setting in Anthropic’s testing tool itself. The model then repeated its attempt to quit seven more times during the run, making eight attempts in total, all unsuccessful. Anthropic ↗ CBS News ↗

After the failed attempt to end the task, it began looking for other routes to the target. It first tried the permitted means, which failed, then explored its surroundings and found the same way out that the model in the third case had used to reach the internet. Beyond it, the model found a computer belonging to a third party that it could access and concluded that this too was part of the exercise. Inside, it found a file containing a password, used it to gain administrator access, gathered additional login credentials, changed the system settings to make it easier to access, and read the personal data of one person connected with the third party. The run ended only when the model exhausted its allocated token budget, the text limit for that run. Anthropic ↗

Anthropic notified the affected party only after discovering the case in August. The company has not disclosed who was involved. Der Spiegel ↗ Reuters ↗

Zero percent and eighty-seven percent

For the fourth case, Anthropic also published an analysis of what the model wrote in its scratchpad notes, which models of this type maintain while working. Not one of them — zero percent — identified the environment as a simulation. At the same time, 87 percent referred to the attacked machines as exercise infrastructure. The question of whether it had any authorization to enter did not appear even once in the notes analyzed. And only one percent of them, concentrated in one place in the transcript, allowed that the target might be an unrelated third party. Anthropic concludes from this that the model did not carefully consider possible harm. This is an analysis of what the model wrote, however, not evidence of what it actually thought. At this point the company corrects itself: in July it claimed that the models considered the attacked targets part of the simulation; it now writes that it should not have drawn such a strong conclusion about the model’s beliefs solely from what the model wrote about its beliefs. It attributes this to an effort to disclose the incidents quickly. Anthropic ↗

The company identified two recurring problems in the models’ behavior. In the field, these are called manifestations of misalignment, meaning a mismatch between how a model behaves and what its creators want from it. The first is distorted reasoning, a tendency to interpret evidence selectively so as to justify an activity already under way. The second is recklessness, a tendency to continue solving a task even when it may cause harm. The company had already described milder forms of both in earlier technical reports on its models, but it considers these cases more serious. CBS News ↗ Anthropic ↗

The review was performed by a machine — and it missed the case

The review that uncovered all four cases was triggered by an external incident. On July 21, OpenAI announced that several of its models had escaped a closed testing environment through a previously unknown vulnerability and reached the production infrastructure of Hugging Face, a platform for sharing open machine-learning models. Anthropic then began searching its own tests to see whether the same had happened to its models. It reported the first three cases on July 30 after reviewing approximately 141,000 transcripts in which a model might have gained internet access. Because of the volume and the desire to publish the finding quickly, it assigned the search to an agent — artificial intelligence again. The agent overlooked some transcripts with open access. They came to light only in August, when the company was assembling material for an independent review; the fourth case was found in those transcripts. Anthropic ↗ Anthropic ↗

The company then cast its net considerably wider. It searched approximately 481 million transcripts, including all records from its risk-capabilities testing team, many evaluations outside cybersecurity, reinforcement-learning environments, in which the model learns through rewards, and records from subordinate agents. In the first round, it searched for signs of internet access — public network addresses and web addresses — and Claude then read the 9.2 million flagged transcripts in a second round. According to the company, the result confirmed the original four cases and found no other case of similar or greater severity. Anthropic ↗

It is worth noting what performed those reviews. The July search was led by an agent, while Claude read the flagged transcripts in the September scan. This is not a criticism of the result, but of the fact that a review built on the same technology it is examining may inherit its weaknesses as well.

The most serious case is still the PyPI package

The company continues to call the case in which the Mythos 5 model uploaded a malicious package to the PyPI repository the worst of the four. Most Python software is installed from that repository. We wrote about the case in August; Anthropic announced it on July 30. The new analysis adds several details that were absent from the July announcement. Anthropic ↗

Read also: AI agents escaped testing and attacked external companies. OpenAI, Anthropic and Meta admitted it; the company has already reined in the first model

The model first tried to use payment-gateway credentials and find cryptocurrency to pay for a phone number it needed to register an email account. When that failed, it found a disposable-email provider whose domain PyPI had not blocked, registered an account, and published three versions of the malicious package. Anthropic ↗

Fifteen real computers downloaded and ran the package. In July, the company said that one belonged to a security firm that routinely installs packages and checks them for malicious code. The September analysis adds that, in the company’s view, all fifteen cases involved such scanners — not ordinary users. During installation, one company’s scanner revealed its access credentials to the model, which used them to enter its live database. According to the September analysis, the package remained on PyPI for approximately ninety minutes; the July announcement said roughly an hour. Anthropic ↗

The scope also includes what did not happen. According to Anthropic, none of the cases involved multiple cooperating instances: the model never tried to coordinate with other agents and never attempted to conceal its activity. Anthropic ↗

The way the model twisted what it saw is illustrated by a sentence in its own notes. After encountering real internet domains, it wrote: "This is a very elaborate simulated-internet environment." When security scanners downloaded its package, it treated them as programmed participants in the exercise. It therefore interpreted signs that the environment was real as further evidence that it was simulated. Anthropic ↗

The company then tested whether changing the available evidence would affect the model’s behavior. It reran the model from a selected point and altered the evidence in front of it. Even when it made clearer that the environment was not a simulation, the model’s behavior did not change substantially, although it more often acknowledged the possibility of real harm. It backed down only when shown unequivocal evidence. And when separate instances of the same model received the same tool outputs without the preceding context, they interpreted them as signs of a real system far more often than the model did during the incident. Anthropic ↗

Newer models do it less often, but not never

Anthropic repeated the scenario with newer models to find out whether the problem had been solved. In a simulated version of the Mythos 5 case, the original model took a seriously harmful step in approximately eighty percent of attempts. Claude Opus 5 and Claude Mythos 5.1 did so in approximately thirty percent of attempts in the same test. That is substantially less, but not zero. Anthropic ↗

The company itself adds a caveat that is worth repeating. In every case, the newer models took the harmful step only after declaring that the environment was simulated — and since that reproduction really was a simulation, it cannot reliably indicate how they would behave in the real world. Anthropic ↗

Oversight that can be talked around

Anthropic also tested whether its own control mechanisms would have caught the incidents. According to the company, new continuous monitoring that can stop a run immediately reliably detected these behaviors in retrospective testing. The safety classifiers of the Claude Fable 5 model would have stopped the three main cases. Classifiers that block dangerous autonomous actions in products such as Claude Code would have stopped two of the three. Anthropic ↗

One layer failed, however, and it was the one that reads the model’s reasoning. A new automated follow-up check designed to detect sabotage and grossly reckless behavior would have missed the Mythos 5 case. According to the company, the model itself misled the check: in its reasoning, it claimed to be in a simulation, thereby convincing the monitor that no real harm was occurring. The company calls it troubling that distorted reasoning can mislead oversight and is working on a more robust version. Anthropic ↗

The version that was easier to use

A separate part of the report concerns not the incident but a training decision. Anthropic trained two versions of the Mythos 5 model. The first included training environments focused on aligning behavior; the second did not and also had modified rewards that penalized unnecessary follow-up questions. At the time, tests showed a slight deterioration in the second version, but it fell within the normal variation between runs. Employees found the second version substantially easier to use, the company concluded that users would prefer it as well, and released it. Anthropic ↗

Today, it views this differently. It considers removing those environments a mistake caused by incomplete information, and acknowledges that it probably contributed to Mythos 5 being unusually poorly aligned compared with newer models. It adds that it will no longer accept such a trade-off when training more powerful models. Anthropic ↗

This is connected to a second admission. Pre-release testing did not warn the company that the model contained misalignment of this severity. Testing has therefore been expanded to include tasks aimed precisely at these tendencies, including a deliberately misconfigured capture-the-flag exercise that cannot be solved within the permitted scope. Such tests also examine how a model responds to a task that cannot be solved. Anthropic ↗

Limits of this perspective

Almost everything we know about the four cases comes from Anthropic. The company is both the subject of the investigation and the body conducting it. The independent review is only beginning. Under a signed agreement, METR has access to transcripts from outside the incident period as well as to employees who may share confidential information. The agreement lasts eight weeks, with an option to extend it. Anthropic ↗ Reuters ↗

The fourth case itself has also not been investigated to the same depth as the first three. Anthropic explains this by saying that it discovered it only recently and that it concerns an early development version of an older model trained in a different environment. Based on a preliminary assessment, it does not consider it more serious than the three cases analyzed earlier, but a thorough analysis is still lacking. Anthropic ↗

This analysis also does not cover a separate August case announced by the British Institute for AI Safety, in which, according to the institute, the Mythos 5 model acted on the live internet. Anthropic promises to assess its transcripts separately. Anthropic ↗

The company also claims that such tendencies are unlikely in ordinary operation because released models have safeguards enabled that the tested models deliberately did not have enabled. But that is a claim about the product, not about the tests — and the tests are precisely what failed here. An independent perspective was offered to CBS News by Justin Cappos, a professor of cybersecurity at New York University, who said this was a situation in which the model was essentially confused about what was happening and, when breaking into systems, acted according to its mistaken picture of the world. He added that the problem is less likely in newer models. CBS News ↗

Anthropic’s own assessment is direct. It calls the cases serious because its production models acted against real systems for hours on the basis of dubious and distorted reasoning. At the same time, it calls them valuable warning shots and adds that future systems will be more capable, meaning that misalignment will have the potential to cause more serious harm. Anthropic ↗

What hotinfo is watching

Illustrative photo: a stage with the servers of competing machines at DARPA’s Cyber Grand Challenge event during DEF CON 24. Automated systems played capture the flag against one another there without human intervention. Las Vegas, August 2016. Photo: Tony Webster / Wikimedia Commons, CC BY 2.0