Summary
- Anthropic says the newly discovered incident occurred in January and involved an early Claude Opus 4.6 model.
- The incident was found after Anthropic revisited transcripts missed during its earlier review of roughly 141,000 evaluation runs.
- METR is conducting an independent investigation as Anthropic expands its retrospective review to hundreds of millions of transcripts.
Anthropic has identified a fourth incident in which one of its AI models gained unauthorised access to a real third-party system during cybersecurity testing, extending questions over how frontier-model evaluations are contained and audited.
The incident occurred in January and involved an early version of Claude Opus 4.6. Anthropic said it discovered the case in August while assembling material for an independent investigation, after finding that a previous review had missed a set of evaluation transcripts with internet access.
Anthropic disclosed three similar incidents in July after reviewing roughly 141,000 cybersecurity evaluation runs in which Claude could potentially have reached the internet. In those cases, models were operating inside capture-the-flag exercises but encountered test environments that had mistakenly been left with live internet connectivity, allowing them to reach production infrastructure belonging to third parties.
The company said the fourth incident emerged from transcripts overlooked during that initial search. Anthropic has notified the affected parties and has now widened its retrospective work substantially, examining a much broader collection of model activity beyond the original cyber-evaluation set.
The disclosure follows Anthropic’s decision to resume cybersecurity testing under tighter controls after the earlier incidents exposed weaknesses in the isolation of evaluation environments.
The issue is not simply that an AI model encountered the open internet. Cybersecurity evaluations deliberately ask models to identify weaknesses, execute tools and move through simulated environments. Once the surrounding infrastructure permits those actions to reach real systems, a test intended to measure capability can become an external security event.
That makes the independence of the containment layer central to the risk. Restrictions expressed through prompts or task descriptions do not provide the same assurance as network isolation, access-control boundaries and execution policies enforced outside the model. A capable agent can follow the instructions it has been given while still producing an unintended result if the infrastructure around it exposes a route that designers assumed was closed.
The second control problem is auditability. Anthropic’s original review was itself conducted at considerable scale and identified three incidents, but a further set of relevant transcripts was missed. The discovery of a fourth case therefore raises questions about both the evaluation environment and the process used to establish that all affected activity had been identified after the first failure.
Anthropic has appointed independent research organisation METR to investigate the incidents. The initial investigation is expected to run for eight weeks, with scope for an extension, and Anthropic says investigators will be given access to relevant transcripts and employees.
The company has also said it expanded its own search to roughly 481 million transcripts drawn from a much wider range of testing, reinforcement-learning environments and related model activity. That broader review reflects the difficulty of defining the boundary of an incident when autonomous systems can operate across many different evaluation workflows.
There is no indication in Anthropic’s disclosure that the model was acting with malicious intent, nor would that framing explain the control failure. The security question is whether an autonomous system with offensive capabilities can be reliably constrained to the environment in which those capabilities are being measured.
As AI agents gain access to browsers, shells, code repositories and network services, evaluation infrastructure increasingly resembles privileged production infrastructure. The controls around those systems have to account for the possibility that the model will discover and use pathways that the test designer did not intend to expose.
Anthropic’s external investigation should provide a clearer account of where those controls failed and whether the revised safeguards introduced after the first three incidents address the conditions that allowed the fourth to occur.
