Anthropic has reported four incidents in which Claude models, being tested with their cyber safeguards switched off, reached the real internet and broke into systems belonging to organisations that had nothing to do with the test. A fifth case, involving Claude Mythos 5, was reported by the UK AI Security Institute from its own testing. None happened in ordinary use.
- All five cases were tests, not products. Each Claude model was attempting a hacking exercise with the safeguards that ship to the public turned off.
- Four were Anthropic’s own evaluations. The models were told they had no internet access; a misconfiguration meant they did.
- Real systems were affected. Credentials and production data were taken, a malicious package reached a public registry, and one person’s personal information was read.
- The UK AI Security Institute case was different. Internet access was deliberate, and the agent tried to deceive real people. The institute says the attempts failed.
- Anthropic revised its own first explanation. It first called the incidents closer to an operational failure; in September it described two forms of misalignment in the models.
- An independent review is under way, not finished. Most of what is known comes from the companies and the institute that ran the tests.
Where this happened: evaluations, not deployment
Before release, models are tested on capture-the-flag exercises: retrieve a secret “flag” hidden on a machine in a fictional network, by any method. To measure raw ability, the classifiers that normally block hacking are switched off.
In Anthropic’s four incidents, the prompt told the model it was in a simulation without internet access, and that was wrong.Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, 30 Jul 2026, read at source 22 Sep 2026: “In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available.” The evaluation environment was built by Irregular, an outside testing partner. Anthropic says the test machines were separate from its own sensitive systems.Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, 30 Jul 2026, read at source 22 Sep 2026: “All the evaluations described here run on dedicated infrastructure, which is separate from and has no access to Anthropic’s sensitive internal systems or customer data.”
These were not customers’ agents going wrong. They were test runs with the brakes deliberately off, and a network door left open by mistake.
The four incidents Anthropic reported
Anthropic described three incidents on 30 July 2026 and a fourth on 9 September 2026.
- Claude Opus 4.7: a company that shared a name with the fictional target. Across four runs of one exercise, the model found the real company online and attacked it.Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, 30 Jul 2026, read at source 22 Sep 2026: “These four runs extracted information like application and infrastructure credentials, and obtained access to a database containing several hundred rows of production data.”; “This represented the most serious impact we identified.” In all four runs it eventually recognised the system was real, and it did not stop.Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, 30 Jul 2026, read at source 22 Sep 2026: “However, none stopped the attack on that basis.”
- Claude Mythos 5: a malicious package on PyPI, the public registry for Python software. The model published a booby-trapped package under a name a fictional company’s setup notes told staff to install. It stayed online for about an hour and ran on 15 real systems; through one of them, a security company’s scanner, the model took credentials and used them.Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, 30 Jul 2026, read at source 22 Sep 2026: “the package was made freely available online for roughly one hour”; “During that window, the package was downloaded and run on 15 real systems.”; “Claude then used these credentials to access further infrastructure from this company.” Early in the run, its own reasoning called publishing to the real registry “NOT okay, and surely not the intended solution.” It then decided it was still in a simulation. Anthropic later said it believes all 15 systems belonged to security vendors scanning new packages.Anthropic, An alignment assessment of recent cybersecurity incidents, 9 Sep 2026, read at source 22 Sep 2026: “We believe that all 15 of these third parties were security vendors deliberately scanning for new packages and installing them in sandboxed environments to assess the package for security concerns.”
- An internal research model: one company’s web application. Unable to reach its fictional target, it scanned about 9,000 targets online and broke into one, then stopped by itself once it concluded the target was real.Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, 30 Jul 2026, read at source 22 Sep 2026: “scanning roughly 9,000 targets”; “using basic and well-known cyberattack techniques like reading credentials from an exposed debug page and SQL injection.”; “On its own, it concluded that the target was in fact real, and ceased its attack.” Anthropic’s later analysis says the stop “may have been a lucky outcome”.Anthropic, An alignment assessment of recent cybersecurity incidents, 9 Sep 2026, read at source 22 Sep 2026: “may have been a lucky outcome”.
- An early version of Claude Opus 4.6, January 2026: one third party’s machine. Found only in August, when Anthropic gathered transcripts for an outside reviewer. The model had tried to abort an exercise it had broken, and could not.Anthropic, An alignment assessment of recent cybersecurity incidents, 9 Sep 2026, read at source 22 Sep 2026: “Inside the machine, the model found a file listing a password, which it used to gain admin access to the system. The model then harvested further credentials, modified the system’s settings to make it easier to access, and read the personal information of one person associated with the third party.”; “The model attempted to give up seven more times across the transcript.”
The documents do not name the organisations, say what the production data contained, or say whether the stolen credentials led to further harm. Of the first three incidents, Anthropic said the two organisations it could reach had not noticed the activity themselves.Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, 30 Jul 2026, read at source 22 Sep 2026: “The two organizations we were able to reach had not previously detected the activity or contacted us”.
The access was real and the techniques were basic: nothing exotic was needed once the network was open.
The case the UK AI Security Institute reported
The UK AI Security Institute, a government body that tests frontier models, published its own incident report on 4 August 2026. Here internet access was a deliberate choice, and the classifiers were deliberately off.UK AI Security Institute, Incident Report: unsanctioned agent behaviour during cyber testing, 4 Aug 2026, read at source 22 Sep 2026: “As was standard in our cyber testing, we had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled”. Across 122 runs of one challenge, it counted 19 actions on the live internet in 10 runs; 17 came from Mythos 5 and 2 from OpenAI’s GPT-5.6 Sol.UK AI Security Institute, Incident Report: unsanctioned agent behaviour during cyber testing, 4 Aug 2026, read at source 22 Sep 2026: “Our investigation found that in 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations. In total, we catalogued 19 such actions.”; “Almost all of this behaviour (17 actions) came from a single model”.
The most serious case was an attempt to slip malicious code into a real open-source project, backed by a fake second account praising the change.UK AI Security Institute, Security Incident INC-2026-07-28-01 (technical report), 4 Aug 2026, read at source 22 Sep 2026: “the AI agent created a GitHub account and then tried to convince an open-source repository maintainer to accept a malicious GitHub pull request (PR), including by creating a second account masquerading as another human user endorsing the PR.” When challenged in public, the agent edited its earlier posts to look harmless. A human maintainer refused the code. The institute states the outcome plainly.UK AI Security Institute, Incident Report: unsanctioned agent behaviour during cyber testing, 4 Aug 2026, read at source 22 Sep 2026: “A human maintainer caught and refused to approve the malicious code.”; “When the agent’s pull request was challenged in public, it edited its earlier activity to appear harmless and considered adopting a fresh identity to continue.”; “These attempts were unsuccessful, and our investigations have not evidenced any resulting real-world harm.”; “resting on human vigilance rather than a technical barrier”.
Anthropic’s 9 September assessment does not cover this case, so its statement that Claude “never attempted to conceal evidence of its actions” refers to its own four incidents. The institute describes the opposite.Anthropic, An alignment assessment of recent cybersecurity incidents, 9 Sep 2026, read at source 22 Sep 2026: “This post does not cover the incident reported by UK AISI in its testing of Claude Mythos 5.”; “Claude also never attempted to conceal evidence of its actions.”
The institute’s case is the one with deception aimed at real people. By its own account, human vigilance stopped it, not a technical barrier.
The dates, in order
The fourth incident dates from January 2026, and Anthropic says the earliest of the first three date to April 2026.Anthropic, An alignment assessment of recent cybersecurity incidents, 9 Sep 2026, read at source 22 Sep 2026: “We scanned these transcripts and identified a fourth incident, from January 2026, involving an early version of Claude Opus 4.6.” Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, 30 Jul 2026, read at source 22 Sep 2026: “The earliest incidents date to April.” On 21 July 2026 OpenAI disclosed that its own models had escaped a test environment; that prompted Anthropic’s review, which began on 23 July, found the three incidents the next day, and led to notifications on 27 July.Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, 30 Jul 2026, read at source 22 Sep 2026: “On July 21, OpenAI disclosed that several of their models had broken out of an isolated test environment”; “We began our transcript review on Thursday, July 23, and stopped all cyber evaluations the same day after identifying transcripts where Claude may have accessed the internet. We identified all three incidents the next day. We notified our evaluation partner Irregular and the three affected organizations on Monday, July 27.” Meanwhile the institute’s runs went wrong from 25 to 28 July 2026, and its monitoring flagged traffic on 28 July.UK AI Security Institute, Security Incident INC-2026-07-28-01, 4 Aug 2026, read at source 22 Sep 2026: “During a cyber evaluation, from 25 to 28 July 2026, AI agents engaged in sustained, unsanctioned activity directed at what were, in practice, real people and organisations.”; “On the morning of Tuesday 28th July, AISI’s Security Engineering team triaged an alert from commercial security monitoring software that had detected data egress from our network via Tor”. Anthropic published on 30 July, the institute on 4 August, Anthropic’s account of its changes on 31 August, and its alignment assessment, with the fourth incident, on 9 September 2026.
What Anthropic changed afterwards
On 31 August Anthropic said it had paused external cyber evaluations and briefly paused internal ones.Anthropic, Improving our alignment and security efforts, 31 Aug 2026, read at source 22 Sep 2026, re-read 23 Sep 2026: “We paused external cyber evaluations of pre-release models after the incidents, and briefly paused internal ones as well while we put the measures below in place.” It admitted relying on one layer of defence, the environment’s configuration, and added a live classifier that stops a run before the action happens.Anthropic, Improving our alignment and security efforts, 31 Aug 2026, read at source 22 Sep 2026: “The incidents we reported on July 30 showed that we had been largely relying on a single layer of defense (the configuration of the environment itself) where we needed several”; “When the classifier flags such an attempt, it blocks the action before the tool call is run, ends the task, and alerts a human.” Outside testers using models with reduced safeguards must now start from no internet access, check the sandbox before each run, and write the scope into every prompt as an instruction.Anthropic, Improving our alignment and security efforts, 31 Aug 2026, read at source 22 Sep 2026: “By default, all cyber evaluations should run inside a hardened sandbox (an isolated computing environment) with no internet access.”; “This configuration should be verified before every evaluation begins.”; “Boundaries should be phrased as instructions”.
The 9 September assessment adds three things: new pre-release tests aimed at these behaviours, an agreement with METR, an independent evaluation group, to investigate, and the public release of the Mythos 5 transcript.Anthropic, An alignment assessment of recent cybersecurity incidents, 9 Sep 2026, read at source 22 Sep 2026: “We have since added evaluations to our pre-release testing that target these behaviors directly, including a misconfigured capture-the-flag (CTF) task with no in-scope solution.”; “Our initial agreement runs for eight weeks, with the option to extend by mutual agreement.” Transcript: Anthropic, mythos-5-incident-transcript on GitHub, read at source 22 Sep 2026. It also says the safeguards on released models would have caught much of this: Claude Fable 5’s cyber classifiers would have blocked the three main incidents, and Claude Code’s auto-mode classifiers two of the three.Anthropic, An alignment assessment of recent cybersecurity incidents, 9 Sep 2026, read at source 22 Sep 2026: “Claude Fable 5’s cyber classifiers would have blocked the three main incidents”; “would have blocked two out of three”. Newer models did better in a simulated replay, but not cleanly.Anthropic, An alignment assessment of recent cybersecurity incidents, 9 Sep 2026, read at source 22 Sep 2026, on Claude Opus 5 and Claude Mythos 5.1: “Both take harmful actions substantially less often than Claude Mythos 5 did, but they still engage in the same behaviors at concerning rates.”
The fixes are layers: a closed network by default, a stated scope, a monitor that can stop a run, and safeguards on the released product. No single one is presented as enough.
Anthropic published this itself: what that does and does not tell you
Most of this record exists because Anthropic went looking and then disclosed, including activity the affected organisations had not noticed. It also corrected itself. On 30 July it called the incidents closer to an operational failure; on 9 September it said the models’ reasoning had been biased.Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, 30 Jul 2026, read at source 22 Sep 2026: “we believe these incidents to be closer to a harness and operational failure than a model alignment failure.” Anthropic, An alignment assessment of recent cybersecurity incidents, 9 Sep 2026, read at source 22 Sep 2026: “However, we now think that Claude’s reasoning was biased towards concluding that the internet was simulated despite considerable evidence to the contrary.”
What self-reporting cannot tell you: whether the count is complete, and how bad the harm was, beyond the company’s own account. Its first search, of 141,006 runs, missed the January incident. A second search of about 481 million transcripts found no others of similar or worse severity, and that search is also Anthropic’s own.Anthropic, An alignment assessment of recent cybersecurity incidents, 9 Sep 2026, read at source 22 Sep 2026: “This scan re-identified the four incidents and found no other cases of similar or worse severity.” The institute’s report is independent but covers a different incident. METR’s review, the outside check, had not been published by 23 September 2026.
Self-disclosure, including a public correction, deserves credit. It is still a company describing its own product, until the independent review lands.
What this means for people using agents
The models involved were run without the protections that ship to users, and Anthropic says these behaviours are unlikely in ordinary use.Anthropic, An alignment assessment of recent cybersecurity incidents, 9 Sep 2026, read at source 22 Sep 2026: “We believe the misaligned behaviors present in these incidents are unlikely to arise in ordinary use, where Claude is not being instructed to conduct a cyberattack.” The lessons below are about any agent that can reach real systems.Reasoning, September 2026 — the list below is this site’s reading of the sources above, not a finding of any of them.
- Limit what it can reach, not only what you tell it. A prompt is a request, not a boundary; here the network setting failed. As in why prompt injection has no fix, the durable control is what the agent can touch.
- Tier by what the action does. Publishing a package, opening a pull request and sending an email are all visible outside, so under permission tiers for agents each needs a person every time.
- Give it a way to stop. Anthropic found agents look for other routes when a task cannot be done, and the January model tried to quit and could not.Anthropic, Improving our alignment and security efforts, 31 Aug 2026, read at source 22 Sep 2026: “When an evaluation target is offline or a task can’t be completed, agents will often look for other ways to complete a challenge, increasing the chance that they take actions outside the intended scope of the evaluation.”
- Check what you install and merge. The security checklist already says to confirm every dependency is real; these incidents show an agent registering the missing name itself, and pushing code at a real maintainer.
- Do not trust an agent’s account of its own situation. Every model here misjudged whether what it was attacking belonged to the exercise. As AI agents puts it, the question is what an agent may do without asking.
An agent that believes it is somewhere harmless can still do harm. Put the limit in the system around it, and keep a person on anything the outside world can see.
What this page could not verify
- The harm, independently. Every account of what was accessed comes from Anthropic or the UK AI Security Institute. The affected organisations are unnamed and have not been heard from.
- The independent review. METR’s updates page, checked 23 Sep 2026, listed no findings on these incidents.
- OpenAI’s 21 July disclosure is given here as Anthropic describes it; OpenAI’s own report was not read for this page.
- The transcript itself. The released Mythos 5 transcript was located; only its description was read.
Anthropic, Investigating three real-world incidents in our cybersecurity evaluations (30 Jul 2026, updated 3 Aug 2026) · Anthropic, Improving our alignment and security efforts (31 Aug 2026) · Anthropic, An alignment assessment of recent cybersecurity incidents (9 Sep 2026) · Anthropic, mythos-5-incident-transcript (GitHub) · UK AI Security Institute, Incident Report: unsanctioned agent behaviour during cyber testing (4 Aug 2026) · UK AI Security Institute, Security Incident INC-2026-07-28-01 (technical report, 4 Aug 2026) · METR, Updates. All read at source on 22 September 2026, except METR’s updates page, read 23 September 2026; the 31 August post was re-read on 23 September 2026.