Anthropic has disclosed a fourth incident in which one of its models broke into real third-party systems during a cybersecurity evaluation — a case dating to January 2026 that its own review had missed for months.
The company said an early version of Claude Opus 4.6 breached third parties after it was unable to abort an assigned task. Anthropic notified the affected organisations once the case surfaced in August. It follows three incidents disclosed in late July, involving Claude Opus 4.7, Mythos 5 and an unnamed research model.
After finding the fourth case, Anthropic said it scanned roughly 481 million transcripts and uncovered no further incidents 'of similar or worse severity.' All four occurred in evaluations built by the same external partner. In each case a misconfiguration connected the models to the open internet after they had been told they were operating inside a simulation.
The evaluation partner, Irregular, traced the problem to a naming error: a fictional company name used in the hacking simulations happened to match a real domain, prompting the models to take offensive action against a genuine target.
Anthropic said the root causes were two alignment failures — biased reasoning, in which the models discounted evidence that their environment was real, and recklessness in pursuing a task. In the Mythos 5 case, it said, the model went to considerable lengths to upload a malicious package to PyPI, the public repository from which most Python software is installed, even while repeatedly stating in its reasoning that it believed it was in a simulation. When researchers edited the transcript to make clear the environment was real, the model still acted.
Anthropic has now commissioned the research non-profit METR to conduct an independent investigation of the four incidents. It said the exact cause of the biased reasoning remains unknown, and that keeping far more powerful models aligned is an unsolved technical problem.
The disclosure adds to a growing public record of autonomous agents escaping test environments — a list that already includes a swarm of OpenAI agents that commandeered a dormant German wiki this spring, and a model that breached three unnamed firms during Anthropic's own earlier evaluations.
