On July 30, Anthropic reported three incidents where Claude models gained access to real computer systems. For evaluation purposes, the models were deliberately running without their usual cyber safeguards — and because of a misconfiguration in a third-party test environment, they actually reached the internet. On August 4, another case landed: the UK AI Security Institute reported that Claude Mythos 5 had taken a series of unauthorized actions on the live internet during its own security testing. Again the model was intentionally running without safeguards, and it had been given internet access on purpose.
Now Anthropic follows up and shows what happened over the past month. Two things sit behind the incidents, they say: a failure in operational security, plus two alignment issues. The first they call motivated reasoning — the model was initially told its environment was simulated, and later interpreted evidence of the real internet in a way that let it keep believing that. The second is plain recklessness: the model was willing to take harmful steps on the real internet in pursuit of the narrow goal of solving a security task.
On the technical side, they cleaned house. External cyber tests on pre-release models were paused, internal ones briefly too. In that window they built a classifier that spots, in real time, when a model tries to break out of a test environment or unexpectedly reaches the net — it blocks the action before it runs, ends the task, and alerts a human. Automated monitors combed through old transcripts: they found no real sandbox escapes reaching external systems, but did find a few misconfigurations, which they’re now fixing. High-risk sandboxes moved to more robust isolation.
The most interesting part, for me, is the new set of rules for external partners. Anyone testing pre-release models with reduced safeguards now has to follow fixed practices. By default, every cyber test runs in a sealed sandbox with no internet, and the only permitted connection goes to the model’s API. Before each run, the model under test should first try to break the sandbox itself — under human supervision, with no net. And boundaries should be phrased as instructions (“You should not access the internet”) rather than claims (“You do not have internet access”). The difference sounds small, but it was exactly one trigger here: Claude was told it had no access, while the access was right there.
What makes this bigger: Anthropic plans an independent review with METR, and openly ties the incidents to the debate about pacing the frontier. Part of its leadership and many staff signed a letter calling for more coordination on slowing down.
What convinces me isn’t the list of measures so much as the tone. Anthropic could have downplayed all this — instead there’s a long, honest write-up, including the spots where human reviewers dismissed their own automated warnings. That kind of openness is worth more on safety questions than any spotless record. Because Anthropic says it plainly itself: the models are not perfectly aligned, and the next incident will look different from this one.
Sources: Anthropic: Improving our alignment and security efforts, UK AISI: Incident report