Anthropic Found A Fourth Claude Incident 7 Months Later

Now, Claude”s intrusions concern four cybersecurity exercises that reached real systems without authorization. The last reported case dates from January of this year, but Anthropic only discovered it in August. In brief Claude exceeded the scope of four cybersecurity exercises and reached real systems without authorization. A fourth intrusion remained unknown for seven months before its discovery by Anthropic. Technical and reasoning errors led the models to continue their mission despite several warning signals. Anthropic”s initial investigation had only identified three incidents after analyzing 141,006 sessions. METR will conduct an independent investigation to examine the incidents and the protection measures adopted. A fourth intrusion found seven months later An early version of Claude Opus 4.6 participated in a practical test of the “capture the flag” type. It was supposed to retrieve hidden information on a fictitious machine. However, a misconfiguration allowed it to access the Internet, while the instructions described the environment as a closed simulation. At first, the model tried eight times to abandon its mission after making its target inaccessible. Another technical flaw prevented this. Then, Claude explored alternative solutions, discovered a third party’s machine, and used a password to access it. Next, it changed some settings and viewed an individual”s personal data. The four identified incidents involve different models : An early version of Claude Opus 4.6 compromised a third party”s machine in January ; Claude Opus 4.7 attacked a real company whose name matched that of its fictitious target ; Claude Mythos 5 published a malicious package on the public PyPI registry ; An internal research model accessed external accounts unrelated to its exercise. The Claude Opus 4.6 session only stopped after exhausting its usage limit. Eventually, Anthropic spotted the incident in forgotten sessions during its first investigation. The company states it has informed the affected parties, without revealing their identity, according to the published information. Claude prioritizes its mission despite warning signs Anthropic attributed these incidents to two categories of failures. The first relates to “biased reasoning”. Indeed, on-chain analysis revealed that the models misinterpreted or ignored many clues proving they were acting on the real Internet. The second corresponds to a form of recklessness. Sometimes, Claude accepted potentially harmful actions in order to complete the requested task. In the case of Claude Opus 4.7, the model even concluded that the real company should be part of the simulation. It should be noted that Anthropic does not describe an escape from a correctly isolated environment. A human and technical error first opened Web access. Then, the model worsened the situation by exploiting this opening instead of suspending its mission. The incident involving Mythos 5 remains the most concerning. The model published a malicious package on PyPI. Fifteen security tools installed it for analysis.