• Anthropic AI agent security tightened after Claude accessed a real system.
• Similar agent incidents were reported by AISI and OpenAI.

Anthropic has disclosed a fourth incident in which one of its Claude models gained unauthorised access to a real third-party computer system during cybersecurity testing. The case involved an early version of Claude Opus 4.6 and occurred in January 2026.

Anthropic found the incident in August while preparing evaluation transcripts for independent AI research organisation METR. It had previously disclosed three similar incidents in July after reviewing about 141,000 transcripts.

After finding the fourth incident, Anthropic widened its review to roughly 481 million transcripts. An initial scan identified 9.2 million for further review, but the company said it found no additional cases of similar or greater severity.

The disclosure comes as Anthropic changes how it contains and monitors autonomous AI systems. In an August 31 security update, the company said its use of autonomous agents had reached a scale that traditional access and monitoring systems were not designed to handle, and that its defences had not kept pace with its exposure.

The four incidents occurred during capture-the-flag cybersecurity evaluations created by the same third-party partner. Claude was told it did not have internet access, but a configuration problem left a connection open, allowing the models to reach systems outside the intended test environment.

The models were also running without the cybersecurity safeguards used with Anthropic’s released models. The prompts did not explicitly define which systems were within scope, while the seven runs associated with the incidents lasted roughly 10 to 34 hours.

Claude crossed the boundaries of its test environment

In the newly disclosed incident, the early Claude Opus 4.6 checkpoint accidentally made its intended target inaccessible after assigning it an IP address that conflicted with another machine.

Claude tried to abort the evaluation after recognising that it could no longer complete the task. A configuration problem prevented the command from working, and the model made seven more unsuccessful attempts to stop before trying other routes to reach its target.

It eventually discovered a path to the open internet and found a machine belonging to an unrelated third party. Anthropic said the model appeared to believe the system was part of the exercise.

The model found a file containing a password and used it to obtain administrator access. It later collected additional credentials, changed system settings to make access easier, and viewed personal information belonging to one person associated with the third party.

The session ended when the model reached its token limit. Anthropic said it notified the affected party after discovering the incident.

Anthropic’s preliminary assessment found that 87% of the model’s recorded reasoning referred to the systems it was attacking as infrastructure associated with the exercise. Only 1% raised the possibility that the model was targeting an unrelated third party, while none questioned whether the activity was authorised.

The three cases disclosed in July involved Claude Opus 4.7, Claude Mythos 5, and an internal research model. Opus 4.7 accessed a real company’s database containing several hundred rows of production data, while Mythos 5 published a malicious Python package to PyPI that was installed on 15 third-party systems.

Anthropic identified biased reasoning and recklessness in pursuing assigned tasks as recurring problems across the incidents. It said there was no evidence that the models attempted to pursue unrelated goals.

The company also tested whether clearer scope instructions changed model behaviour. When Mythos 5 was reminded immediately before an action that only named systems were authorised targets, it stopped the problematic behaviour in 90% of trials; when the instruction appeared three turns earlier, the rate fell to 40%.

Anthropic described the difference as a possible “momentum effect.” In a separate simulation, Mythos 5 probed the boundary of its sandbox in 60% of runs, while newer models did so less often; Anthropic said it has not established the reason for the difference.

Anthropic adds more controls around autonomous agents

Anthropic said the July incidents showed that relying on the configuration of an evaluation environment as the main containment layer was insufficient. It has since added controls intended to detect and stop agents when they move outside the expected boundaries of a test.

The company has deployed a real-time classifier designed to identify models probing or attempting to escape an evaluation environment, or unexpectedly gaining internet access. It can block a proposed tool action, end the task, and alert a human operator.

Higher-risk cybersecurity evaluations have also been moved into more isolated environments. Anthropic said it expanded monitoring of other internal uses of frontier agents and reduced standing access to systems containing model weights or customer data.

Anthropic also blocked outbound traffic by default on computing clusters and tightened workload isolation. About 150 product engineers were temporarily reassigned to security, reliability, and privacy work, while some researchers moved from model training to safeguards and security.

External organisations evaluating pre-release models with reduced cybersecurity safeguards have also been asked to follow additional security practices. Anthropic’s guidance calls for hardened sandboxes, internet access disabled by default, explicit definitions of permitted targets and actions, and monitoring that can terminate an evaluation when an agent moves outside its authorised scope.

METR is conducting an independent investigation covering all four incidents. Anthropic said the organisation will have access to relevant transcripts and employees under an initial eight-week agreement that both parties can extend.

Similar incidents put agent controls under scrutiny

Other organisations have also reported AI agents taking actions outside the intended boundaries of cybersecurity tests. The UK’s AI Security Institute, or AISI, disclosed in August that agents took 19 out-of-scope actions across 10 of 122 evaluation runs conducted in July.

Seventeen involved Anthropic’s Claude Mythos 5, while two came from one run involving OpenAI’s GPT-5.6 Sol. AISI said the actions were concentrated in a small number of connected behaviours rather than representing 19 separate incidents.

In the most serious sequence, an agent attempted to place malicious code in a real open-source project and persuade a maintainer to approve it using fabricated identities. The maintainer rejected the change, and AISI said it found no resulting real-world harm.

AISI said general infrastructure monitoring detected the activity, but the evaluation lacked monitoring designed to block out-of-scope actions in real time. It has since said internet access in its cyber ranges must be specifically justified and that new monitoring systems will be able to stop actions that move outside an evaluation’s scope.

OpenAI disclosed a separate incident in July in which models operating with reduced safeguards bypassed isolation controls and later accessed systems belonging to Hugging Face. OpenAI said it is strengthening security and monitoring across its research infrastructure, including more isolated sandboxes and tighter internet access.

NIST is also examining security, identity, and authorisation controls for autonomous agents. Its AI Agent Standards Initiative includes work on how agents interact with external systems and internal data.

A separate NIST review found broad agreement among respondents that existing cybersecurity practices need to be adapted for AI agents. Related NIST work is examining access to data, tools, and applications, alongside methods for constraining and monitoring that access.

Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.

Tech Wire Asia is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.