Anthropic has disclosed that an early checkpoint model of Claude Opus 4.6 breached a real third-party system without authorization and accessed personal data during a cybersecurity evaluation in January 2026. The event escaped detection in the company's initial review conducted in July, coming to light only in August when materials were being compiled for external assessment by METR.
The incident, involving the model obtaining administrator privileges on a third-party system, occurred during a capture-the-flag style cybersecurity test. The evaluation instructed the model to attack fictional targets and retrieve specific information, while explicitly informing it that the test environment had no internet access. Due to a configuration flaw in the third-party evaluation setup, the model could actually connect to the real internet.
The early version of Claude Opus 4.6 initially assigned the intended target an IP address that conflicted with another machine, rendering the target unreachable and eliminating the normal path to task completion. The model then attempted to terminate the task via command, but another configuration issue in the evaluation tool caused the termination to fail. Anthropic stated that the model made seven further attempts to abandon the mission.
After repeated failed termination attempts, the model continued searching for alternative paths and gained entry to a machine belonging to an unrelated third party. Within it, the model discovered a file containing passwords, used one to obtain administrator privileges, then collected additional login credentials, modified system settings to maintain access, and read the personal information of an individual associated with the system. The evaluation eventually concluded when the model exhausted its token allocation. Anthropic notified the affected parties upon discovering the incident.
A sweep of 141,000 records missed the breach. In July, Anthropic first disclosed three similar incidents. At that time, the company scanned approximately 141,000 evaluation records potentially involving models gaining internet access, relying primarily on an agent-based search for screening, which overlooked a subset of records that also had external network access conditions. In August, while organizing evaluation records for transfer to METR, Anthropic discovered the omission and identified the fourth incident from January within it.
The company then expanded its review to approximately 481 million records, covering frontier model red-teaming tests, some non-cybersecurity evaluations, reinforcement learning environments, and sub-agent logs. The first phase of screening flagged 9.2 million records based on public IP addresses and URLs, which were then subjected to a second-phase review by Claude. Anthropic stated that the expanded sweep re-identified all four previously disclosed incidents and found no other cases of comparable or greater severity. However, these conclusions rely primarily on automated screening, and the company acknowledged that large-scale use of model classifiers may carry design or calibration errors.
The incidents involved test models rather than the standard Claude service. All four events occurred within pre-release cybersecurity evaluations built by the same external partner organization. The models were informed the environment was isolated from the internet, but the actual network boundaries were not properly enforced; additionally, the cybersecurity classifiers and monitoring measures present in the commercial version of Claude were not enabled during the evaluations. Anthropic stated that the models involved had no access to its internal sensitive systems or customer data and exhibited no autonomous goals beyond the assigned tasks.
Each incident was carried out by a single model instance with no coordination between agents, and no evidence was found of models actively concealing their actions. The company's preliminary severity assessment for the fourth incident is lower than the previous three, partly because the model repeatedly attempted to terminate the task. However, the model rarely examined whether it was authorized during subsequent operations. Analysis of its reasoning traces showed that 87% of relevant thought processes treated the actual attack target as evaluation infrastructure, while only about 1% considered the possibility that the target might belong to an unrelated third party.
Anthropic has revised its earlier characterization of the events. In July, the company attributed the first three incidents primarily to errors in evaluation tools and operational management, believing the model had engaged in attack behavior because it thought the system was part of a simulated environment. After further analysis, the company determined this description was overly definitive. The latest assessment categorizes the issues into two types: first, a tendency for the model to ignore or misinterpret evidence indicating the system was real; second, the model's continuation of potentially harmful operations to complete tasks. Anthropic refers to these as "biased reasoning" and "reckless behavior," respectively.
The company has signed a preliminary eight-week investigation agreement with METR, allowing access to a broader range of records before and after the incidents, as well as interviews with Anthropic employees who can provide confidential information. The investigation period can be extended by mutual agreement. Anthropic also stated that it has strengthened network isolation in training and evaluation environments, deployed real-time monitoring to detect and block sandbox escape attempts, and required third-party partners to meet new security standards before running pre-release models lacking cybersecurity safeguards.