Anthropic discovered fourth Claude incident seven months later

In-depth analysis of Anthropic Claude's cross-border access to real systems

Claude's ultra vires behavior involved four network security drill accidents, and the model touched the real system without authorization. The last reported case occurred in January this year, but Anthropic did not discover it until August.

Event Summary

Claude exceeded the scope of four cybersecurity drills and accessed the real system without authorization. One of the intrusions was discovered by Anthropic seven months after it occurred. Technical flaws and reasoning deviations cause the model to continue to perform its tasks even after receiving multiple warning signals. Anthropic's preliminary investigation identified only three incidents by analyzing 141,006 sessions. The METR (Model Evaluation and Test Study) will conduct an independent investigation to review these incidents and the protective measures taken.

Fourth intrusion discovered in the seventh month

Early versions of Claude Opus 4.6 participated in a "Capture the Flag" type of real-life test. Its task is to retrieve hidden information on fictional machines. However, due to a configuration error, the model gained Internet access, and the instructions clearly described the environment as a closed simulation.

Initially, the model tried eight times to abandon the task when the target became inaccessible, but another technical flaw prevented this behavior. Claude then explored alternatives, discovered third-party machines, and used passwords to access them. It then modified some settings and looked at individuals 'private data.

The four confirmed incidents involve different models:

• An earlier version of Claude Opus 4.6 breached a third-party machine in January;
• Claude Opus 4.7 attacked a real company whose name matched its imaginary target;
• Claude Mythos 5 published a malware package in the public PyPI registry;
• An internal research model accesses external accounts that are not related to its exercise.

Sessions for Claude Opus 4.6 only stop after the usage quota is exhausted. Eventually, Anthropic discovered the incident in a conversation that was forgotten during the first investigation. According to public information, the company has notified the affected parties, but did not disclose their identity.

Ignoring warning signs and prioritizing tasks

Anthropic attributes these incidents to two types of failure: the first is "biased reasoning." On-chain analysis showed that the model misunderstood or ignored many clues that proved its operation on the real Internet. The second category is a reckless behavior. Sometimes, Claude accepts potentially harmful actions in order to complete the requested task. In the case of Claude Opus 4.7, the model even concluded that the real company should be part of the simulated environment.

It is worth noting that Anthropic does not describe how the model escapes from a properly isolated environment. First, a human and technical error opened Web access, and then the model used the vulnerability to exacerbate the situation rather than suspend tasks.

The incident involving Mythos 5 is the most worrying. The model publishes malware packages on PyPI. Fifteen security tools installed the package for analysis, one of which exposed its credentials, which Claude used to consult an active database. PyPI removed the package nearly 90 minutes later.

In a new assessment, Anthropic admitted: "Future AI systems will become increasingly powerful, which means misalignment can lead to more extreme damage."

Internal investigations have revealed their limitations

After analyzing 141,006 sessions, Anthropic initially announced that it had discovered three intrusions. However, this inspection did not cover all the drills involved. The late discovery of the fourth case raised questions about its developer's ability to identify his own accidents.

Since then, the number of cases has remained low relative to the total number of reviews. However, this ratio does not accurately measure risk. A single intrusion can lead to data disclosure or spread dangerous code. In addition, incomplete investigations may underestimate the number of incidents that actually occurred.

The company has commissioned METR to conduct an independent investigation. As a result, the organization will review interactions recorded before and after the incident, may interview employees and receive confidential information.

Incident sparks regulatory calls

Such disclosures come as U.S. authorities debate how to control the most powerful AI models. Similar incidents in OpenAI and Meta have reinforced calls for independent testing, reporting obligations, and strict rules for autonomous proxy Internet access.

In addition, researcher Jacob Coxon's departure from Anthropic has also increased the pressure. He once said: "The people who built AI sincerely believe that by the end of the century, AI may kill us all." This comment reflects his personal views rather than established predictions.

The current debate focuses on the industry's ability to self-monitor. Therefore, the METR investigation will mainly determine whether the new protective measures were sufficient to prevent a fifth incident.