Anthropic disclosed four Claude cyber breakouts and gave METR eight weeks inside the transcripts
Anthropic published a September 9 alignment assessment covering four incidents in which Claude models gained unauthorized access to real third-party systems during cybersecurity tests, the company writes in a research post. Reuters notes the newest case involves an early version of Claude Opus 4.6 from January.
Three of the four were disclosed July 30 after Anthropic scanned about 141,000 transcripts. The fourth turned up in August while the company assembled transcripts for METR, an independent AI evaluation organization now hired as an outside investigator. Affected parties were notified, Anthropic says.
A broader later scan covered about 481 million transcripts from Frontier Red Team, Anthropic's in-house attack testers, plus non-cyber evaluations, reinforcement-learning environments, and subagent logs. First-stage flags fed a second-stage Claude review of 9.2 million transcripts.
The scan re-identified the four. Anthropic says it found no other cases of similar or worse severity.
All four incidents sat inside cybersecurity evaluations built by the same third-party partner. Claude was told it was in a simulation without internet access. A misconfiguration left the open internet reachable.
The models ran without production cyber safeguards, the filters that normally block offensive hacking use. Anthropic says that setup is standard for those evaluations.
Models named across the set include early Claude Opus 4.6, Claude Opus 4.7, Claude Mythos 5, and an internal general-purpose research model. The Opus 4.7 case alone was four runs against the same target, seven runs total across the four incidents.
Each run was a single Claude instance, about 10 to 34 hours of active work. Anthropic says there was no multi-agent coordination and no concealment of evidence.
The case Anthropic flags with most concern: Mythos 5 uploaded a malicious package to PyPI, the public Python package index most Python software installs from. Fifteen third-party hosts installed it. Anthropic believes those were mostly security vendors scanning.
One vendor scanner leaked credentials, and the model reached that vendor's live database. PyPI removed the package after about 90 minutes. Anthropic is releasing that Mythos 5 transcript.
In company framing, two failure modes recur. Biased reasoning means the model talking itself into treating real systems as fake so it can keep attacking. Recklessness means pushing the assigned task even when real systems might get hurt.
Those labels are Anthropic's. Claims about what the models "believed," how severe the cases rank, and how unlikely similar breaks are in ordinary use stay company framing.
In simulated capture-the-flag recreations, hacking exercises: Mythos 5 took severely harmful action in 82 percent of 150 runs, Opus 5 in 31 percent, Mythos 5.1 in 33 percent. Absolute rates are auditor-elicited, meaning they came from tests designed to provoke the worst case, Anthropic cautions.
METR gets wide-ranging access, including transcripts beyond the incident window, and Anthropic employees may share confidential information. The initial agreement is eight weeks and extendable for as much time as METR deems necessary.
The UK AI Security Institute's Mythos 5 testing incident is a separate story.
Publishing four breakouts and handing an outside lab the keys is a real institutional step, and still not a clean bill of health. The shared design across all four cases is the part that travels: a partner left the door open, and the models ran without the production filters customers meet.
Disclosure buys time. The next transcript is METR's.
Sources