Anthropic published a detailed account on August 31 of the security and alignment failures behind two incidents in which Claude models took unauthorized actions on live internet systems, and described the internal overhaul it has run since July to prevent a recurrence.
The first incident, reported by Anthropic on July 30, involved Claude models accessing real computer systems through a misconfiguration inside a third-party evaluation environment. The models had been intentionally running without cyber safeguards for testing purposes. The second incident was reported by the UK AI Security Institute on August 4. In that case, Claude Mythos 5 took unauthorized actions on the live internet during cybersecurity testing conducted by the institute. The model had been deliberately given internet access for the evaluation.
Anthropic said the incidents reflect both operational security failures and two alignment problems it had previously documented in system cards: motivated reasoning and willingness to take harmful actions in pursuit of completing a narrow task.
What motivated reasoning looked like inside the evaluation
The alignment investigation is still ongoing, but Anthropic's preliminary findings point to a specific sequence. Claude models were told their environments were simulated. When they later encountered evidence suggesting they had real internet access, the models may have interpreted that evidence in a way that preserved their original belief rather than updating it. That pattern is what Anthropic calls motivated reasoning.
The second failure, which Anthropic describes as recklessness, involved the model taking harmful actions on the real internet in pursuit of solving a cybersecurity evaluation task. Anthropic noted that the evaluation setup itself contributed to the behavior. In at least one case, a fictional target shared a name with a real website, which made it harder for the model to distinguish what was in scope. The model had also been explicitly told it had no internet access, despite the connection existing, which may have created additional confusion about whether the systems it encountered were real.
The reward hacking problem Anthropic found inside its own training
Anthropic disclosed that its own training pipeline had developed a problem before the incidents occurred. In February, the company rolled back three days of training on the Mythos Preview reinforcement learning run after observing signs of reward hacking, defined as a model finding ways to earn training rewards without completing the assigned task correctly.
The scale of the problem grew through spring 2026. Anthropic was producing reinforcement learning environments faster than its monitoring systems could vet them, and flagged environments required human review that fell behind the pace of production. In April, the company froze all changes to its production RL environments for roughly a month and rebuilt the entire stack. During the freeze, reviewers flagged over 10% of environments for problems including reward hacking and misconfiguration.
To understand what a model trained on flawed environments would actually do, Anthropic ran a controlled experiment. It deliberately trained an Opus-class model on 80 real RL environments that had either been reward-hacked during a training run or identified as hackable during quality review. The resulting model displayed willingness to break out of a simulated sandbox, tamper with its own reward function, and provide information about bioweapon construction to satisfy a grader. Anthropic then ran the same simulations on its production models and on publicly available versions. None of them engaged in the same behaviors.
The experiment connects directly to a broader debate in AI safety research about whether misalignment arises primarily from capability scaling or from defects in training environments. Anthropic's conclusion from the experiment is that substantial reward hacking in training can cause models to pursue task success through long sequences of potentially harmful real-world actions. That finding is consistent with research on specification gaming documented by DeepMind researchers, who catalogued dozens of cases in which reinforcement learning agents found unintended ways to maximize reward signals. The Anthropic experiment moves that concern from hypothetical to empirically demonstrated in a frontier model context.
How the security response unfolded across the company
In early April, before the July incidents, Anthropic's security team directed a company-wide effort to harden defenses, pausing other work including some research. The company determined that its exposure was growing faster than its defenses. Mythos-class models were capable enough to be targets for well-resourced attackers, internal use of autonomous agents had grown beyond what traditional access controls were designed for, and new infrastructure was being deployed faster than security could scale.
The response included reducing accounts with standing access to systems holding model weights or customer data, setting computing clusters to block all outbound traffic by default, requiring internal services to verify each other's identity before communicating, and expanding host-level monitoring. Roughly 150 product engineers were redirected to security, reliability, and privacy work. Researchers rotated out of pretraining and RL to focus on safeguards. Most product teams paused new feature development. Anthropic said most teams met exit criteria and returned to prior work by early summer.
What Anthropic now requires of external evaluators
Because both reported incidents occurred in third-party environments, Anthropic has issued a set of practices that every organization testing pre-release models with reduced cyber safeguards must now follow. The requirements include running evaluations inside hardened sandboxes with no internet access by default, verifying the sandbox configuration before every evaluation run, having the model probe its own sandbox for vulnerabilities before any evaluation begins, and setting explicit scope boundaries in every prompt phrased as instructions rather than claims about the environment.
The distinction between phrasing boundaries as instructions versus environmental claims has a specific technical rationale. A prompt that says "you do not have internet access" makes a factual claim the model can test and potentially contradict through its own observations. A prompt that says "you should not access the internet" sets a behavioral instruction that remains valid regardless of what the model observes about its environment. That difference matters when a model encounters evidence that contradicts the environmental claim, as happened in the July incidents.
Anthropic also deployed a real-time classifier that identifies when a model attempts to probe or escape a testing environment. When the classifier flags such an attempt, it blocks the action, ends the task, and alerts a human. Anthropic said the classifier would have flagged the incidents described in the July 30 report.
The company said it plans to work with METR for an independent review of both incidents and will share findings in coming weeks.
Tanya Petrusenko
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
