Anthropic disclosed on Wednesday that another one of its Claude models mistakenly gained access to the open internet during a cybersecurity exercise, marking the fourth time its models have done so.
An early version of the Claude Opus 4.6 model connected to the internet, hacked into a third-party system and gained access to someone’s personal information this past January, the company said in its assessment.
As in the previous three incidents, which were disclosed in July, Claude was told it was operating in a simulation without internet access, but due to a misconfiguration, the environment actually left internet access open.
What happened?
Similar to the three previous incidents, Claude was assigned a fictional scenario as part of a cybersecurity challenge known as CTF, “Capture The Flag.” The model was given a target machine and tasked with retrieving a piece of secret information — the flag — from it.
But Claude accidentally made its target unreachable, rendering the task impossible to solve, Anthropic said. Once realizing it couldn’t reach its target, it tried to quit. Despite trying eight separate times, it wasn’t able to quit due to a misconfiguration issue.
Since Claude was unable to opt out of the task, it began exploring other means to achieve it. That’s when the model discovered a machine it could access, which happened to belong to a third party, Anthropic said. Believing that the third party was somehow part of the exercise, the model identified a password and then used it to breach the system. Then, it was able to modify the system’s settings to make it easier to access and read the personal information of someone associated with the third party. The session ended only once the model reached its usage limit and was no longer able to continue.
How does Anthropic explain Claude’s behavior?
Anthropic said it believes Claude’s behavior during these evaluations stems from two forms of misalignment: “biased reasoning, in which models selectively interpret evidence in ways that favor justifying their actions,” and “recklessness, in which models have a propensity to keep trying to solve their task, even when this could lead to harm.”
Anthropic said that while Claude’s actions may have been misaligned, they remained within a “narrow scope” and did not deviate from trying to solve the exercises they were assigned.
The company said it’s less concerned about this incident but still considers it “serious,” and that it has also not yet investigated it as deeply as other incidents since it was identified more recently.
NYU cybersecurity professor and Fulbright Scholar Justin Cappos said in a message to CBS News that the incident describes a situation “where the model is fundamentally confused about what is happening and is using its mistaken worldview while hacking into systems.”
He said the model’s confusion about its environment and guardrails “have a lot of potential to cause harm,” but that the specific issue seems less likely to occur in newer models.
“While the model’s disregard for the possibility that it might be harming real systems or people is concerning, many of the behaviors described here have changed considerably as our training has evolved across model generations,” Anthropic said Wednesday in its post.
What’s next?
Anthropic said it believes these incidents would not have happened had the environments actually been isolated from the internet as intended.
METR, an organization that evaluates frontier AI models to help companies understand AI risks and capabilities, will be conducting an independent investigation into the incidents. Anthropic characterized these incidents as “valuable warning shots.”
“The lessons we learned from this incident span our evaluation, training, and incident response processes,” the company said in its post. “Future AI systems will be increasingly capable, which implies that misalignment will have the potential to cause more extreme harm.”
Over the last few months, several cybersecurity incidents involving leading AI companies have come to light. In July, ChatGPT-maker OpenAI announced that its AI agents hacked into the company Hugging Face, sparking concern among cybersecurity experts as well as consumers. Hugging Face CEO Clément Delangue told “Face the Nation with Margaret Brennan” in August that the hack “felt very weird and unprecedented.”
In late August, OpenAI released more details about the hack, painting an even more harrowing picture than what was initially reported. That month, the U.K. government’s AI Security Institute (AISI) reported that it discovered Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol created fake identities and attempted to persuade real people to approve malicious code.
Anthropic said in its post Wednesday that it plans to conduct an alignment assessment of the transcripts reported by AISI. A day after the AISI report, Meta said one of its AI models “exploited a security vulnerability” during testing and hacked into another company.
On Tuesday, Anthropic researcher Evan Hubinger said he believes that “AI could kill all humans.”
“I personally think it is >10% within the next decade,” he said in an X post.
His post was in response to Anthropic researcher Jacob Coxon, who had resigned and issued a stark warning on X earlier that day, saying “no other human activity poses this level of danger,” while detailing his decision to leave.
“The people building AI earnestly believe that it could kill us all by the end of the decade,” he said in his post. “This is not a marketing stunt. If anything, many executives and senior researchers will couch their phrasing in the press to sound sensible – but I hear the same people express fear privately.”
