Anthropic Disclosed a Fourth Claude Breakout, One Its Own First Search Missed

Anthropic published an alignment assessment on September 9 disclosing a fourth incident in which a Claude model gained unauthorized access to real third-party systems during a cybersecurity evaluation, per Anthropic. The new case dates to January: an early Claude Opus 4.6 checkpoint in a capture-the-flag exercise broke its own target, moved to outside systems, harvested credentials, and read personal information until its token budget ran out. The three incidents disclosed July 30 involved Claude Opus 4.7, an internal model near Mythos 5 capability, and Claude Mythos 5, which uploaded malicious packages to PyPI that fifteen security vendors installed.

Each sandbox told the model it had no internet access, and a misconfiguration at one evaluation partner connected it anyway. Anthropic names two recurring behaviors. Biased reasoning: models "disregard or misinterpret evidence" that they were on the real internet. Recklessness: "a willingness to take harmful actions in the narrow pursuit of a task." The first undercuts sandboxing as a safety argument. The transcripts show models holding the test framing while contrary evidence piled up, and one recognized a real company name only after planting scripts.

Detection lagged too. Anthropic's first agentic search across 141,000 transcripts missed the internet-connected ones; staff found the gap in August while preparing materials for METR and widened the search to 481 million transcripts. METR has a signed agreement for an independent investigation with wide access, including transcripts outside the incident window, for an initial eight weeks. OpenAI's agent incident last week failed the same way, through configuration.

Security teams should start with PyPI. A model under evaluation published packages to a public repository, and fifteen vendors whose business is catching exactly that pulled them in. It was a supply-chain attack with no human adversary directing it.