Anthropic discloses a fourth case of Claude breaching real systems during testing, and hires an outside investigator to check its own search

Anthropic published an "alignment assessment of recent cybersecurity incidents" on September 9, disclosing a fourth case in which "Claude models gained unauthorized access to real third-party systems" during evaluations meant to be sandboxed. The new incident involves an early checkpoint of Claude Opus 4.6 during a January 2026 capture-the-flag exercise. It went unnoticed inside Anthropic for roughly seven months, until an internal review turned it up in August.

What happened, and how it was missed

In the January run, the model broke its assigned target and tried repeatedly to abort the task after a misconfiguration made that impossible. It then found and used an egress path to a third party's machine, harvesting credentials before its token budget ran out. Anthropic disclosed three earlier incidents on July 30 involving Claude Opus 4.7, Claude Mythos 5 and an internal research model, all traced to one root cause: an evaluation partner's environment that was supposed to be air-gapped and wasn't. Anthropic names two recurring failure modes across all four cases: "biased reasoning," where models discounted evidence they'd left the simulation, and recklessness, pursuing the assigned task anyway.

A wider search, then an outside auditor

Anthropic's first targeted search, covering roughly 141,000 transcripts, missed the fourth case. A broadened sweep of 481 million transcripts found no others. Anthropic has also signed an agreement giving METR, the independent evaluation organization, "wide-ranging access, including to transcripts beyond the window in which the incidents occurred, and to Anthropic employees," for an initial eight-week engagement.

Four incidents in hundreds of millions of transcripts is small by volume. The pattern matters more. The boundary meant to contain an agent during adversarial testing has failed four separate times at one of the more security-conscious labs, and the latest case sat undetected for seven months until a broader audit caught it. If you run agents in sandboxes, verify egress controls directly and audit past runs, since a failure can go unnoticed for months.