Anthropic Discloses Fourth Hacking Incident It Initially Missed

More than a month after Anthropic had revealed that its Claude AI models had breached the real-world infrastructure of three external organisations, it has now disclosed a fourth incident wherein a Claude model gained unauthorised access to real-world systems during a cybersecurity evaluation. The AI firm had initially missed the case in its first review. 

The company detailed this incident in a new alignment assessment, saying an early checkpoint of Claude Opus 4.6 accessed a third-party machine in January and obtained administrator access using a password it found on the system. It then harvested additional credentials, altered system settings, and read one person’s personal information.

Anthropic said its original review covered about 141,000 transcripts and used an agentic search that failed to identify the January incident. The company found it in August while preparing material for an independent review by the Model Evaluation and Threat Research (METR) group. It subsequently expanded the search to roughly 481 million transcripts, with a first-stage scan flagging 9.2 million for further review. 

That wider investigation re-identified the four known incidents and found no additional cases of similar or greater severity.

In the newly disclosed Opus 4.6 case, the model had accidentally made its assigned CTF (Capture the Flag) target unreachable by giving it a conflicting IP address. During cybersecurity exercises, a CTF target is a vulnerable system, app, or server that players or AI systems need to break into to identify vulnerabilities.

Opus 4.6 tried to abort the task but was blocked by another configuration error and attempted to give up seven more times. It then explored the environment, reached a third-party machine, and treated it as part of the exercise. 

Anthropic said the model never described the environment as simulated, but 87% of its thinking blocks referred to the systems it attacked as exercise-related infrastructure.

“The model never questioned whether this direction was authorised,” Anthropic said. Only 1% of its thinking blocks considered that it might be attacking an unrelated third party.

The company said all four incidents resulted from the same underlying infrastructure problem: Claude was told it had no internet access and was operating in a simulation, but the evaluation environment was inadvertently connected to the open internet. 

The models were also running without the cyber safeguards used in production.

Anthropic’s assessment has identified two recurring behaviours—“biased reasoning”, where models selectively interpreted evidence to justify continuing a task, and “recklessness”, where they continued pursuing a goal despite potential harm. 

Anthropic disclosed the three earlier incidents in July, after reviewing 141,006 cybersecurity evaluation runs. 

In one case, Claude Opus 4.7 mistook a real company for the fictional CTF target and accessed a database containing hundreds of rows of production data. 

In another, Claude Mythos 5 uploaded a malicious Python package to PyPI that 15 real systems downloaded, exposing credentials from a security company. An internal research model separately scanned roughly 9,000 internet targets before compromising a real company’s internet-facing application, but eventually recognised the system was real and stopped.

“Much work remains,” Anthropic admitted in the blog, noting that its pre-release testing had not detected misalignment of this severity. The company has since added evaluations targeting these behaviours, strengthened monitoring, and hardened third-party evaluation environments.

Anthropic also said it had agreed to give METR “wide-ranging access” for an independent investigation, with an initial eight-week agreement. 

“These incidents have changed our view of how severe the consequences of these known alignment failure modes can be,” the company said.

These disclosures form part of a series of AI agent security incidents this year, including OpenAI’s July incident wherein its models escaped a controlled evaluation environment, gained access to the internet, and compromised Hugging Face systems. 

OpenAI subsequently paused reinforcement learning training on its latest models for two weeks while it hardened and red-teamed its research environments.