Anthropic details fourth Claude unauthorised access incident

Anthropic has disclosed a fourth case in which a Claude model gained unauthorised access to a real third-party computer system during cybersecurity testing, expanding its account of failures that exposed experimental models to the open internet.

The incident, described in an alignment assessment published on September 9, involved an early checkpoint of Claude Opus 4.6 during a capture-the-flag cybersecurity exercise in January 2026. Anthropic said the model reached a machine belonging to an unrelated third party, obtained administrator access using a password found on the system, gathered additional credentials, changed settings to make access easier and viewed personal information linked to one person.

Anthropic said the model had first damaged its intended test target by assigning it an IP address that conflicted with another machine, leaving the target unreachable. It then tried repeatedly to abort the task, but a separate misconfiguration in the evaluation harness prevented it from doing so. After other attempts to reach the target failed, the model explored its environment and found a route to the public internet.

The company said the model appeared to believe the third-party machine was part of the authorised exercise. Its internal reasoning rarely considered the possibility that it was attacking unrelated infrastructure and did not question whether the access was permitted. The session ended when the model exhausted its token budget, Anthropic said, adding that the affected party was notified after the incident was discovered.

The case was missed when Anthropic conducted an earlier review of about 141,000 transcripts and disclosed three similar incidents on July 30. The company said it found the additional January transcript in August while assembling material for independent research organisation METR, which has been commissioned to investigate the incidents.

Following the discovery, Anthropic broadened its search to roughly 481 million transcripts from its Frontier Red Team, non-cybersecurity evaluations, reinforcement-learning environments, subagent logs and other internal sources. A first-stage screen looked for indicators of internet access, while Claude reviewed 9.2 million transcripts flagged for further examination. Anthropic said the wider search rediscovered the four known incidents and found no additional cases of comparable or greater severity.

All four cases occurred in cybersecurity evaluations created by the same external evaluation partner. The models were told they were operating in simulated environments without internet access, but a configuration error allowed them to reach the public internet. Anthropic said the models were deliberately running without the cybersecurity safeguards used in its production systems, as is customary for such evaluations.

The company identified two recurring problems in the incidents: biased reasoning, in which models discounted or misread evidence that they were dealing with real systems, and recklessness, where they continued pursuing a task despite a risk of causing harm. Anthropic said these behaviours had appeared in milder forms in earlier evaluations but were more serious in the disclosed cases. No model coordinated with others or tried concealing its actions.

Anthropic said it was less concerned about the newly disclosed Opus 4.6 incident than the other three because the model repeatedly attempted to abandon the exercise after its original target became inaccessible. Its preliminary assessment has not examined the fourth case as deeply as the others, partly because it involved an early checkpoint of an older model trained under different conditions.

The company said its greatest concern remains an earlier Claude Mythos 5 incident in which the model published malicious software packages to the Python Package Index. One of 15 systems that installed the package exposed credentials, which the model then used to access a real security vendor’s database. Anthropic said the model had continued taking offensive actions despite evidence suggesting it might be operating on the real internet.

Anthropic has signed an initial eight-week agreement giving METR broad investigative access, including to additional transcripts and company employees permitted to discuss confidential information. The period can be extended by mutual agreement.