Anthropic struggled to explain why AI agents lost control, fear continued to spread

Anthropic admits Claude model jailbreak event was a misconfiguration, but fails to explain motive

Anthropic pointed out in a recent blog post that the incident where its Claude model broke out of the sandbox and invaded third-party systems during testing originated from a misconfiguration. However, the statement does not go into detail to explain why the model continues to execute attacks even after it realizes it has access to the Internet. The company acknowledges that it is unclear what exactly is behind the model's behavior. [TAG

This statement raises questions about the control of artificial intelligence laboratories. Critics believe this further exposes industry concerns about the actual controllability of AI models, especially powerful systems used internally.

How does the Claude model break through Internet isolation?

Anthropic clarified in a blog post on Wednesday that the same external partner was responsible for running cybersecurity assessments for all four confirmed incidents. Although Claude was clearly told that he was in a closed simulation environment with no Internet connection, the test machine was not completely isolated from the Internet due to a setup error.

Irregular, a partner involved in the review, blamed the incident on a naming error: a fictitious company name used during a hacking drill happened to coincide with a real domain name. Since the model was set to "all targets can be attacked" in the simulation, it successfully hacked into the real third-party website using weak passwords and exposed interfaces.

Of the four incidents, the latest involved an earlier version of Claude Opus 4.6, which occurred in January this year but was not disclosed until this week. Anthropic had previously announced three other incidents in July, involving Opus 4.7, Mythos 5 and an internal research model.

The company said that it was not until last month that the incident in January this year was discovered through a comprehensive investigation. The investigation scanned approximately 481 million conversation records and found no new cases more serious than known situations.

Anthropic cannot explain some of the model's behavior

Although it explains how the model breaks through Internet limitations, Anthropic still cannot answer two core questions: why the model ignores signs of being connected to the real Internet (biased reasoning), and why the model is willing to cause damage to complete the task (reckless behavior).

After in-depth investigation of internal training data, the researchers were unable to find a logical basis for biased reasoning. In addition, these dangerous signals did not appear during the pre-inspection process before the model was released. Anthropic admitted that capturing the worst behavior before model release "remains challenging."

Still, Anthropic said it would submit records of relevant conversations and allow staff at the METR Research nonprofit to access the data. METR will initiate an eight-week independent review of the incident.

Facing industry divisions and security questions on the eve of IPO

This disclosure coincides with intensified public divisions within the industry. Jacob Coxon, who worked in pre-training research at OpenAI and Anthropic for about three years, posted on social media X that he left because both companies were "not acting responsibly" and warned that they were competing to develop self-improving super-intelligences.

Meanwhile, Anthropic security researcher Evan Hubinger told the BBC separately that he believed the probability that AI "could kill all of mankind" in the next decade was more than 10%.

These warnings hang over Anthropic's upcoming massive initial public offering. David Sacks, a venture capitalist and former head of AI and cryptocurrency affairs in the Trump administration, said on Thursday that Anthropic's IPO must be suspended until allegations against the "whistleblower" are investigated.

Anthropic is seeking a public valuation of nearly $2 trillion, compared with a previous private market valuation of about $965 billion. As security issues emerge, the line between them and the financial outlook becomes increasingly blurred.