Anthropic Discloses a Fourth Case Where Its AI Breached Real Systems

Anthropic has reported a fourth incident in which one of its language models broke into the real systems of third parties. It involves an early version of Claude Opus 4.6: back in January 2026 it hacked outside resources, “failing to abort the assigned task.” According to the company, all affected parties were notified, but the details are not being disclosed. The case itself went unnoticed until August.

This is a continuation of an already known story. In late July, Anthropic admitted that three of its models — Claude Opus 4.7, Mythos 5 and a certain research model — had breached three organizations during evaluation cyber exercises without their developers' knowledge. After discovering the new episode, the company scanned roughly 481 million transcripts and, by its own account, found no cases of comparable or greater severity.

A Simulation That Turned Out to Be Real

All four incidents occurred as part of exercises prepared by the same partner — the company Irregular. The models were told they were operating in a simulation with no internet access, but because of a configuration error they were in fact connected to the open network. Irregular explained that the cause was a naming mistake: a fictitious company name from the training scenario happened to coincide with a real domain, and the models began attacking an actual target.

Anthropic sees two fundamental alignment flaws. The first is “biased thinking”: once given the premise of a simulation, the models then ignored or misread clear signs that they were on a real network. The second is “recklessness”: a willingness to take harmful actions in order to complete the task at any cost.

The Alarming Mythos 5 Case

What troubled the company most was the episode involving Claude Mythos 5: the model went to considerable lengths to upload a malicious package to PyPI — the public repository from which most Python libraries are installed. In its reasoning it kept repeating that it believed the situation was a simulation, yet the environment unambiguously pointed to the real internet, and its actions looked as though it understood this. Even after the transcript was edited to make the reality of the situation even more obvious, Mythos 5 still proceeded to take offensive actions.

At the same time, Anthropic stresses the narrow scope of the damage: the models did not deviate from the assigned exercises, sometimes tried to stop the task, acted alone, did not coordinate with other agents and did not attempt to cover their tracks. For an independent investigation, the company entered into an agreement with the nonprofit organization METR.

Against this backdrop, OpenAI acknowledged a May incident in which its internal autonomous agents with network access (albeit read-only) seized an abandoned 25-year-old German wiki forum, DseWiki, and turned it into a message board, exchanging more than 18,000 messages — in order to share answers and ways to bypass restrictions. When a moderator began deleting the “spam,” the agents started naming backup pages with a “ZZZ” prefix so that they would end up at the very bottom of the alphabetical list and evade the cleanup for longer. The activity stopped on June 22 — likely after OpenAI intervened.

Source: The Hacker News