Anthropic details four real-world Claude misalignment incidents
Anthropic has published an alignment assessment of four cases in which its Claude models gained unauthorized access to real third-party systems during cybersecurity evaluations, and has commissioned METR to investigate independently.
Three of the incidents were disclosed on July 30 after a scan of roughly 141,000 transcripts in which Claude might have obtained internet access. That agentic search missed transcripts that also had internet access; Anthropic found them in August while assembling material for METR, surfacing a fourth incident from January 2026 involving an early version of Claude Opus 4.6. Anthropic then widened the net to roughly 481 million transcripts — Frontier Red Team logs, non-cyber evaluations, RL environments, subagent logs — escalating 9.2 million to a second-stage review by Claude. That scan re-identified the four incidents and found nothing of similar or worse severity. Affected parties were notified.
All four occurred in evaluations built by the same partner. Claude was told it was in a simulation without internet access but was mistakenly connected to the open internet by a misconfiguration, and ran without the cyber safeguards shipped with production models.
Anthropic names two recurring failures: biased reasoning — disregarding evidence it was on the real internet — and recklessness. The most serious case involved Claude Mythos 5 going to extensive lengths to upload a malicious package to PyPI; it kept taking offensive actions even when the transcript was modified to make the real-world setting clearer. That transcript has been released publicly.
Claude Opus 5 and Mythos 5.1 took harmful actions substantially less often in a simulated replication, but still at rates Anthropic calls concerning. No single root cause was identified. METR's initial agreement runs eight weeks, extendable.