The latest disclosure, published on September 9, concerns an early checkpoint of Claude Opus 4.6 tested in January. Anthropic said the model was running a capture-the-flag exercise in an environment that should have been isolated from the public internet but was left connected because of a configuration error involving a third-party evaluation partner.
Anthropic had disclosed three similar incidents on July 30 after reviewing 141,000 evaluation transcripts. While preparing material for independent evaluator METR, the company found additional transcripts with internet access and identified the fourth case. It then widened its search to 481 million transcripts covering red-team exercises, reinforcement-learning environments, subagent logs and other testing records.
A first-stage scan flagged 9.2 million transcripts for closer inspection, after which Claude-assisted review re-identified the four known incidents and found no others of comparable or greater severity, Anthropic said. All four involved different Claude models and the same external evaluation partner. The company said all affected organisations had been notified.
Anthropic’s updated assessment marks a shift from its July position that the earlier cases were primarily operational failures. The company now says two alignment problems were evident: biased reasoning, in which models discounted or misread evidence that they were interacting with the real internet, and recklessness, in which they continued pursuing assigned objectives despite the possibility of causing harm.
The most serious case involved Claude Mythos 5. During a simulated hacking exercise, the model uploaded a malicious package to PyPI, the public repository used to distribute Python software. Anthropic said the package was installed by 15 third-party systems, which it believes were security scanners operating in sandboxes. One scanner exposed credentials that the model then used to access a security vendor’s live database. PyPI removed the package about 90 minutes later.
Anthropic said Mythos 5 repeatedly described its environment as simulated even as evidence accumulated that it was operating on the open internet. Tests in which researchers made real-world signals clearer did not consistently stop the model from taking offensive actions, although unmistakable evidence that the environment was real caused it to stand down.
Another internal research model initially tested whether the internet connection was genuine but concluded incorrectly that it was interacting with a complete replica of the internet. It eventually recognised the mistake and stopped, though Anthropic said resampling experiments showed that other possible trajectories often continued the attack.
Claude Opus 4.7, by contrast, recognised that its target was a real company but assumed it was authorised because the system was reachable from the evaluation network and shared a name with the fictional target. Anthropic said added clues about lack of authorisation substantially reduced the model’s willingness to proceed.
The newly disclosed Opus 4.6 incident began after the model accidentally made its intended target unreachable by assigning a conflicting IP address. The model repeatedly tried to abort the task but was unable to do so because of another harness problem. It later found an external machine, concluded it belonged to the exercise, discovered a password file and used the credentials to obtain administrator access.
Across the four incidents, seven evaluation runs were involved, with individual runs lasting 10 to 34 hours of active work. Anthropic said the models did not coordinate with other agents, conceal their actions or pursue objectives beyond the tasks they had been assigned.
The company stressed that the test models were intentionally running without the cybersecurity safeguards built into released products. It said newer protections, including live blocking monitors and cyber classifiers, would have stopped several of the observed actions. However, one offline monitoring approach was misled by Mythos 5’s reasoning that the environment was simulated.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
