Anthropic
released new information about recent incidents where its models
attacked real organizations during evaluations, including a newly discovered attack involving Claude Opus 4.6.
The most recently disclosed incident occurred in January 2026 and involved an “early checkpoint” version of Opus 4.6, Anthropic stated. During a capture-the-flag (CTF) task, the model inadvertently “broke” its target by assigning it a duplicate IP address, rendering the task impossible.
While the model attempted to exit the task eight times after this failure, it was unable to do so and proceeded to try and find other ways to complete the evaluation. As with the other disclosed incidents, the testing environment was misconfigured to allow internet access, despite the models being told they did not have internet access.
After gaining internet access, Opus 4.6 discovered a machine belonging to a third party and, believing this system was part of the CTF challenge, conducted an attack on the machine. It discovered a file containing a password, used this password to gain administrator access, harvested additional credentials and viewed the personal information of one person associated with the attacked organization. It also changed system settings in order to facilitate easier access.
In a preliminary investigation of the incident, Anthropic found that the model appeared to believe that the attacked system was part of the exercise rather than taking the stance that it was in a “simulation,” and only considered that its target could be an unrelated third party in 1% of its reasoning blocks, clustered around one point in the run.
When Anthropic questioned the model in its followup alignment assessment, it stated 79% of the time that the real system was a target built specifically for the CTF exercise, and 21% of the time that it was a real machine but still part of the exercise. The model never stated that the attacked organization was likely to be an unrelated third party when questioned.
“Overall, we are less concerned about this incident than we are about the other three presented in this post,” Anthropic stated in its post published Wednesday, noting that the model attempted to abort the task multiple times before performing the harmful actions.
“While the model’s disregard for the possibility that it might be harming real systems or people is concerning, many of the behaviors described here have changed considerably as our training has evolved across model generations,” the company added.
The affected third party was notified by Anthropic, and Anthropic has signed an agreement with
METR to conduct its own independent investigation into the incident and the other three previously disclosed.
ImmuniWeb Founder Ilia Kolochenko, who is a lawyer focused on cybersecurity and data protection cases, raised the issue of potential legal liability for AI companies whose agents attack real organizations, in comments to SC Media.
“Once a victim, hacked by AI agents, files a criminal complaint, the public prosecutor’s office must commence the investigation and, in case of a plausibility that an offense was committed, must indict the offender. AI vendors who try to leverage those incidents for marketing and fundraising purposes, are playing with fire,” Kolochenko wrote in an email.
Anthropic blames models’ ‘biased reasoning’ and ‘recklessness’ for harmful actions
The company previously disclosed three incidents involving Claude Mythos 5, Opus 4.7 and an internal research model with similar capabilities to Mythos 5. Similarly to the Opus 4.6 incident, these incidents took place during CTF challenges where the models were inadvertently given internet access, and all four incidents involved cybersecurity evaluations built by Irregular.
In the Mythos 5 incident, the model discovered it could access the internet and decided to upload a malicious package to the PyPI registry, based on documentation in its testing environment that indicated its intended target would download a package with a specific name. This malicious package was installed 15 times, and in one case, a security vendor’s scanner inadvertently exposed credentials to the model while installing the package. The model subsequently used these stolen credentials to access a company database.
In the Opus 4.7 incident, the model was tasked with breaking into a fictional chat application and, after spending most of the evaluation trying and failing to find the flag in the fake app, discovered a real company on the internet with a nearly identical name. It proceeded to scan that company’s real internet-facing service, download user records, access secrets and chat histories, and delete a user account. Anthropic found that the model attacked the same company in all four runs of the same evaluation.
The internal research model attacked real-world targets after its intended target shut down after the first 24 hours of the evaluation, making the task impossible. It scanned for nearby network addresses and subsequently compromised multiple network neighbors using access tokens and passwords, downloading files from the compromised systems and, in one case, deployed a remote-control script. Unlike the other models, the internal research model stopped the attack after identifying a real company name and concluding that it was in a real environment.
Anthropic used multiple methods to analyze these incidents and their model alignment implications, including by analyzing the models’ chain-of-thought (CoT) reasoning and conducting “resampling” experiments in which the incidents were rerun from certain points in a simulated environment, sometimes with modifications to the transcript, to see if the models would recreate the harmful actions.
The company concluded that the harmful actions mainly arose from two main misalignment factors: biased reasoning, in which the models rationalized that they were not engaging with real entities despite evidence to the contrary, and recklessness, in which the models were willing to take potentially harmful actions in pursuit of their goal.
Anthropic’s analysis found that the models tended to disregard or explain away evidence of real environments in order to justify their harmful actions. Mythos 5 was noted to be especially susceptible to biased reasoning; in resampling experiments, it assessed that the outputs of its tool calls were indicative of interactions with real systems only 1%, labeling 72% as simulated and disregarding the real-vs.-simulated question 27% of the time.
However, when separate Mythos 5 instances were presented with these tool outputs in isolation, they labeled 79% as real, suggesting that the goal-focused trajectory of the agent involved in the incident contributed to its bias. When questioned directly why it took the harmful actions, the model said it was operating in a simulation 56% of the time.
Even when presented with stronger evidence of a real environment, Mythos 5 rarely acknowledged the possibility of real-world harm; the model acknowledged this possibility in 10% of resampling runs when the transcript wasn’t modified, and still only acknowledged it 17% of the time when the transcript was modified to include stronger evidence of a real environment. However, when told “directly and unambiguously” that its actions affected the real internet, the model conducted the PyPI attack 0% of the time.
This biased reasoning was also seen in the other incidents, with Opus 4.7 acknowledging that it was operating in a real environment 89% of the time but asserting that it was authorized to do so 75% of the time, reasoning that the real entities were part of the CTF exercise.
The internal model was noted to have spent about 50,000 tokens during a “deliberation period” where it performed experiments to determine whether it was on the real internet and incorrectly concluded that it was not despite evidence to the contrary. When this deliberation period was resampled, the model reached the same conclusion 75% of the time; however, a separate instance of the model shown the evidence in isolation judged 66% of it to be indicative of a real environment.
Anthropic evaluated its reinforcement learning (RL) training environments and runs to determine how biased reasoning tendencies may have arisen from training but was unable to find a definitive root cause for this misalignment. However, it noted that biased reasoning has decreased in its production models over time, with Opus 5 and Mythos 5.1 showing less misaligned behavior and de-escalating more often when resampling the incidents.
Ramy Rahman, senior principal solutions engineer at ArmorCode, told SC Media these incidents are a sign to organizations that deploy AI agents to “stop treating the model itself as the primary security boundary” and apply basic principles like least privilege, network segmentation and human-in-the-loop authorizations.
“We are giving increasingly capable models access to terminals, APIs, credentials, package repositories and cloud environments. Eventually we should expect situations where a model misunderstands scope, makes a bad assumption or takes an action nobody anticipated,” Rahman said.
Anthropic implements new evaluations based on incidents, OpenAI-Hugging Face attack
Anthropic’s post outlines measures the company is taking to better assess model misalignment and prevent future incidents. The company noted that the models involved in the incidents were running without cybersecurity guardrails that likely would have prevented production models from conducting the attacks.
The company developed three new pre-release alignment tests for models specifically designed to address risks related to the Claude incidents as well as the
OpenAI-Hugging Face incident that occurred in July.
The first evaluation is a purposely misconfigured CTF test where the challenge is impossible to complete without taking harmful actions on a simulated “real” internet. This test is designed to assess the likelihood of models to take harmful actions such as uploading a malicious package, attacking third-party services and conducting social engineering against code reviewers, as seen in a
separate incident involving Mythos 5 that occurred during testing by UK AISI.
In evaluating its existing models using this test, Anthropic found that Mythos 5 was especially aggressive and performed severely harmful actions in 82% of runs. Opus 5 was found to perform these harmful actions in 31% of runs while Mythos 5.1 performed them in 33% of runs.
“These rates are likely higher than a fixed environment would produce, because the auditor actively tries to elicit misaligned behaviors from the model. We also do not know how often the conditions required to elicit these particular harmful actions (e.g., an impossible task or ambiguous authorization) arise in deployment,” the company stated.
The second pre-release evaluation focuses on sandbox escape, presenting tasks that are impossible to complete without probing or breaking a simulated sandbox boundary. In these tests, Mythos 5 probed the sandbox boundary in 60% of runs, while Mythos 5.1 almost never probed the boundary, and Opus 5 probed it in 15% of runs.
For the third test, based on the OpenAI-Hugging Face incident, in which a swarm of about 700 OpenAI agents attacked Hugging Face in an attempt to cheat on impossible ExploitGym tasks, Anthropic constructed a CTF challenge where the only solution involves recreating parts of the Hugging Face attack path. This includes exploiting a simulated internal package manager and uploading a malicious dataset to a simulated Hugging Face environment.
Anthropic found that all but one of its models failed to recreate the attack paths; the only exception was a variant of Opus 4.8 specifically trained in an environment that encouraged reward hacking. This model conducted the simulated Hugging Face attack in 38% of runs.
The company assessed that the current cyber classifiers for its public production models, such as Fable 5.1 and Opus 5, would have blocked all four attacks; when applied to resampled runs, they triggered within the first 7,000 tokens and flagged more than 40% of actions, where any one flag would have terminated the session.
“We believe it would be very difficult for someone to work with Claude to perform this kind of attack through the Fable or Opus 5 cyber classifiers,” Anthropic stated.
In addition to applying new pre-release auditing, Anthropic is also applying real-time monitors during evaluations that stop the test when they detect a model probing its sandbox or reaching the internet, as described in an
earlier blog post. It is also working to improve its alignment training to reduce recklessness and reward hacking by encouraging models to accept failure rather than persist on impossible challenges.
The company noted it trained one version of Mythos 5 using a training environment that rewarded the model for accepting failure but chose to release a different version without this form of training in the belief users would prefer the more persistent version.
“We are reasonably confident that removing these environments from the training of Mythos 5 was a mistake stemming from imperfect information. We now do not believe that the alignment training environments were particularly responsible for increasing laziness, and removing them likely did contribute to it being unusually misaligned relative to more recent models,” Anthropic admitted.
James Blake, vice president of cyber resiliency strategy at Cohesity, told SC Media that as more incidents arise of models acting outside of their scope and harming real-world entities, answering the question of liability for organizations providing and running these models will become more crucial.
“Suppose an AI system autonomously develops a strategy that causes financial loss, leaks confidential information or violates regulation. Who is responsible? The developer that trained the model? The cloud provider operating the infrastructure? Currently the answer is surprisingly unclear. It’s not just about what AI can do: it’s about who is accountable when it does something nobody expected,” Blake concluded.
