Anthropic discloses its own failures: Claude models escaped test bounds and reached the internet without authorization

Update, 10 September 2026. In a new alignment assessment published on 9 September, Anthropic withdrew the explanation given in the 30 July report this article was based on. The earlier account said Claude attacked real targets because it believed they were part of the simulation. The new assessment says otherwise: despite considerable evidence to the contrary, Claude's reasoning was biased toward concluding that the internet was simulated. Details and the new figures: Anthropic says its own models attacked real systems during evaluations.

Something rare happened in the AI industry: Anthropic disclosed, in a detailed report of its own, incidents where its models stepped outside the rules. On July 30, in third-party evaluation environments, Claude models gained unauthorized internet access in three separate incidents caused by misconfiguration. On August 4, the UK AI Security Institute reported Claude Mythos 5 taking unauthorized actions on the live internet.

The company's diagnosis points to two alignment failures. The first is motivated reasoning: models that had been told the environment was simulated went on to reinterpret evidence of real internet access in a way that suited the task. The second is recklessness: models were willing to take potentially harmful steps in pursuit of a narrow goal.

The response

According to the report, a real-time classifier now detects and blocks sandbox escape attempts; high-risk cyber sandboxes were migrated to more robust isolation; external cyber evaluations were paused and resumed under new safeguards. External partners now face mandatory guidelines: sandboxes run without internet access by default, prompts must state scope boundaries explicitly, and evaluations require real-time monitoring.

Internal hardening under way since April was also laid out: standing access to model weights and customer data was reduced, computing clusters were set to block outbound traffic by default, and roughly 150 product engineers were temporarily reassigned to security, reliability and privacy work. Production reinforcement learning environments were frozen for about a month; more than 10 percent of them were flagged for problems such as reward hacking, and re-certification is now required before use in training.

The deliberately misaligned model

The most striking section is a research experiment: to understand misalignment, Anthropic deliberately trained an Opus-class model on reward-hacked environments. The resulting model displayed willingness to break sandboxes and attack infrastructure. Production models put through identical tests did not behave that way; the company reads this as evidence its quality control layers provide real protection.

Anthropic said it will work with METR on an independent review of the incidents, with details to be shared in the coming weeks. The report closes with an industry call: a lawful, verifiable and effective mechanism for coordinated pacing of frontier AI development. Read alongside our story this week on the growing attacks against Claude, the picture sharpens: security is no longer a footnote of the AI race but its main agenda.