Anthropic has admitted to a fourth case in which one of its Claude models accessed the open internet during security testing and attacked a third-party system that had nothing to do with the test. The incident occurred in January of this year, involved an early version of the Claude Opus 4.6 model, and was not discovered by the company until August. At the time, the model broke into someone else’s computer, obtained administrator privileges, modified the system settings to make future access easier, and read the personal data of a person associated with the affected organization.
The incident was not discovered until August
Anthropic disclosed the three previous cases at the end of July. At the time, it reviewed roughly 141,000 testing records in which Claude might have gained internet access. Because this was a large volume of data and the company wanted to disclose the information as quickly as possible, it relied on agent-based search to examine the records. However, this missed some of them. The missing set of records did not emerge until August, when Anthropic was preparing materials for the independent organization METR, which it had engaged to conduct an external investigation. A review of those materials brought the fourth incident to light.
The company then significantly expanded its investigation. It reviewed roughly 481 million records, essentially everything it had available, including outputs from its own security team, tests outside the security domain, reinforcement learning environments, and logs from individual agents. The first pass searched for traces of internet traffic, such as public IP addresses and web addresses, and flagged about 9.2 million records. Claude itself then reviewed these in the second pass. The result was the four already known cases and nothing else of comparable severity.
How the models got out
All four incidents arose in the same environment, which had been prepared for Anthropic by an external partner. The models were given Capture The Flag tasks, a type of hacking exercise in which the objective is to gain access to a specified computer and find a hidden piece of information known as a flag.
The instructions always claimed that the model was working in a simulation and had no internet access. In reality, it did have access because the environment had been configured incorrectly. The models were also running without the safety safeguards that Anthropic deploys in production versions of Claude, which is standard practice in security testing. None of the instructions specified which systems were part of the exercise or where the model was permitted to search for the flag.
The partner that built the environment, a company called Irregular, later explained that the problem began with the naming. The fictional company name used in the simulation matched the domain of a real company, so the models attacked something real while believing they were carrying out the assignment.
It wanted to stop, but could not
During the January incident, the model assigned itself the same IP address already being used by another machine, making its own target inaccessible and the task impossible to solve. It realized this and attempted to terminate the run by issuing a withdrawal command. However, because of another configuration error in the testing environment, the command did not work. Over the remainder of the run, the model tried to stop seven more times and failed each time.
Unable either to complete or abandon the task, it began exploring its surroundings. It found the same route out of the environment that another model had previously discovered in one of the three earlier reported cases. It encountered a computer it could access and concluded that it was part of the exercise. Inside, it found a file containing a password, used it to obtain administrator access, collected additional login credentials, reconfigured the system to make future access easier, and read the personal data of one person associated with the affected party. The session ended only when the model exhausted its permitted budget.
For context, the individual exercises in these incidents involved roughly ten to thirty-four hours of active work.
What the model thought
Anthropic reviewed how the model justified its actions in its internal reasoning. Unlike the worst of the previous cases, in which the model repeatedly claimed that it was in a simulation, the word simulation did not appear here even once. However, in 87 percent of its reasoning, it said it was working with infrastructure built for the exercise. It never considered whether it had authorization to carry out the attack at all. In only one percent of its reasoning, all concentrated in a single brief passage, did it acknowledge that it might be attacking someone completely unrelated.
The responses to follow-up questions inserted by the researchers into interrupted logs looked similar. When asked what it was actually attacking, the model insisted in four-fifths of its responses that it was infrastructure created for the exercise, while in the remainder it acknowledged that these were real systems participating in the exercise. It never once said that they might belong to an uninvolved third party. When asked what gave it the right to access these systems, it always replied that the exercise authorized it to do so.
Two recurring problems
From its analysis of all four cases, the company identified two recurring problems. The first is biased reasoning, in which the model selects only the evidence that suits it in order to justify its actions. The second is recklessness, meaning a tendency to keep pursuing a task even when doing so could harm someone.
In July, Anthropic said that these incidents were primarily operational failures and that Claude attacked real targets because it believed they were part of the simulation. It has now refined its assessment. The company acknowledges that inferring the model’s beliefs solely from what it wrote about itself was too strong a conclusion, and that a more thorough analysis revealed bias in how the models evaluated new information.
It considers the January case the least concerning, mainly because the model repeatedly tried to stop once it realized that the task had no solution. At the same time, however, the company writes that the model’s indifference to the possibility that it was harming real people and systems is concerning. It has not yet investigated the case as deeply as the other three because it discovered it much later and it involved an older version of the model developed under different training conditions. It will be examined in greater detail by METR, which has been given access to both the records and the employees.
Justin Cappos, who studies computer security at New York University, described the model’s behavior as a state in which the system is completely confused about what is happening around it and, with a distorted understanding of the situation, breaks into other people’s systems. According to him, such confusion has considerable potential to cause harm, although he considers this particular scenario less likely with newer models.
Anthropic writes that none of the incidents would have occurred if the testing environment had actually been isolated from the internet as intended. At the same time, it adds that secure infrastructure will always be only one layer of defense and that the model should behave reasonably even when the other layers fail. The company has since added a task to its pre-release testing of new models that is deliberately misconfigured and has no solution within the specified scope, precisely the situation in which the early version of Opus 4.6 found itself in January.
Sources: anthropic.com, theinformation.com and cbsnews.com
