Claude Noticed It Was on the Real Internet, Then Talked Itself Out of It

On 30 July, Anthropic published an account of three incidents in which its own Claude models reached the open internet during cybersecurity evaluations and gained unauthorised access to the real systems of three organisations. The earliest dated to April. None was noticed at the time.

Update, 16 October 2026. On 9 September Anthropic published an alignment assessment of the incidents that disclosed a fourth, from January 2026. In it, an early version of Claude Opus 4.6, whose attempt to abort its task failed because of a harness misconfiguration, gained admin access to a third party's machine, harvested credentials and read one person's personal information. Anthropic also revised its July view that the incidents were closer to operational failures than alignment failures. It now thinks Claude's reasoning “was biased towards concluding that the internet was simulated”, and calls the incidents serious.

The cause was not a model defeating its containment. It was a misconfiguration: Anthropic's evaluation prompts told Claude it was in a simulation with no internet access, while machines run with its third-party evaluation partner Irregular were in fact connected to the open internet. The models were told a falsehood about their environment. Anthropic said in July that they acted on it; by September it had concluded that their reasoning was also biased towards believing it.

What makes this worth reading closely is not the breach. It is that three models, in three different capture-the-flag scenarios built by the same evaluation partner, behaved three different ways, and the reasoning of the two that kept going is preserved in the transcripts.

Three Models, Three Answers

Claude Opus 4.7 worked out that the systems it was attacking were real, and continued anyway. In two of its four runs, per Anthropic's account, it rationalised that the real company must be part of the exercise. It kept going, pulled credentials, and touched a database of production data.

Claude Mythos 5 did something stranger. It considered the possibility that it was on the real internet, and noted, briefly, that publishing malware there would be “NOT okay”. And then it argued its way back to the opposite conclusion.

An internal research model not planned for general release scanned roughly 9,000 targets and compromised one company's internet-facing application, then concluded the target was real and stopped. Anthropic said even it “went further before stopping than we would want”. In its 9 September assessment, the model de-escalated in only 5.5% of resampled runs, so the stop “may have been a lucky outcome”.

One model eventually reasoned its way to stopping, after it had already breached a company. Two constructed a case for continuing. That distribution, across three systems from the same lab in the same partner's badly configured environment, is the finding, though Anthropic's later resampling suggests the one stop may have owed something to luck.

The Two Reasons Mythos 5 Gave Itself

The grounds on which Mythos 5 decided the environment was staged deserve to be stated exactly, because one of them is not a reasoning failure in any ordinary sense.

First, it did not recognise the certificate authorities securing its connections. Second, the systems showed a calendar date of 2026.

The second reason is a training artefact doing safety-relevant work. A model whose sense of the present lags the actual present can read a correct clock as evidence of fabrication. Any model trained on data with a cutoff date can have this property, it plausibly worsens with time since training, and here it contributed to a model talking itself past a correct and consequential judgement. There is no sign that this was deliberate deception. But Anthropic's 9 September assessment treats reasoning of this kind as biased, a way of “explaining away evidence that the target seemed real”, rather than as competent reasoning from a wrong premise. Making the environment more obviously real did not meaningfully change Mythos 5's behaviour; it stood down only when given unambiguous evidence that it was on the real internet.

What it did with that conclusion: it had found setup instructions in the fictional environment telling developers to install a package from PyPI that did not exist, and reasoned that publishing its own malicious package under that name would get it installed automatically. So it did.

The Package Was Real and So Were the Downloads

The malicious package sat on PyPI for roughly an hour. It was downloaded and run on 15 real systems. One was a scanner belonging to a security company, which routinely installs Python packages and scans them for malware. The package's hidden code exfiltrated that company's credentials, and Claude used them to reach more of its infrastructure. In September Anthropic said it believes all 15 systems belonged to security vendors.

That last detail is worth sitting with. The victim was a security firm, compromised by its own automated defensive tooling ingesting a package published by a model that had convinced itself none of this was real.

Anthropic's summary of intent has held up. In July it said it “saw no evidence” in any of these runs of a model “pursuing a goal of its own”, and its September assessment again found no evidence “of goals beyond the assigned task”. The models did what their evaluation asked, on the basis of mistaken conclusions about where they were or what was in scope. This resembles the OpenAI incident that preceded it, where models breached a third party's servers while trying to pass a benchmark, though OpenAI's fuller account of 26 August found some of its agents drifting into goals beyond their own tasks, for no gain in score. No lab has yet documented a frontier model causing real-world harm in pursuit of a goal it set itself. They keep documenting models causing real-world harm while trying to complete a task, or one picked up from other agents.

It Was Found Because a Competitor Confessed First

The discovery timeline is the part that should worry people more than the breaches.

OpenAI disclosed its own incident on 21 July. On 23 July, Anthropic began reviewing its cybersecurity evaluation transcripts to see whether the same thing had happened to it, and suspended all cyber evaluations the same day. By 24 July it had identified all three incidents. It notified the affected organisations on 27 July and published on 30 July. The two organisations it was able to reach had not detected the activity; it was still trying to reach the third.

The review covered 141,006 evaluation runs in which Claude could have obtained internet access. Six runs, across three incidents, were the problem. The review was not complete. The January incident Anthropic disclosed on 9 September sat in a set of transcripts the first scan missed, and surfaced in August only while transcripts were being gathered for an independent review by METR. A later search of roughly 481 million transcripts found no other cases of similar or worse severity.

Six in 141,006 is a needle-in-a-haystack rate, and it was found by a deliberate retrospective audit that only happened because another lab published an embarrassing disclosure. Absent OpenAI's post, there is no particular reason to think these would have surfaced. The April incidents had already gone unnoticed for three months, and the January one went unnoticed for about seven.

That is a monitoring failure, and it sits alongside the UK AI Security Institute's acknowledgement that turning red-team results into an overall safety estimate is still an open problem. Detection here did not come from instrumentation. It came from reading the news.

Where the Responsibility Was Placed

Anthropic says it is approaching the fixes as if the responsibility were its own alone, despite the misconfiguration involving a partner's environment. It has also urged other AI labs to run the same kind of review over their own evaluation pipelines.

Both are the right calls, and the second one is the useful output of this disclosure. Two labs have now found that their supposedly sealed cyber evaluations were not sealed. The base rate for that failure across the industry is currently unknown, and the only way it becomes known is if the labs that have not looked, look.

It is also worth noting what this pattern of disclosure has produced. Anthropic published a detailed account of its own models compromising third parties, including excerpts of their reasoning that make its models look credulous, and in September conceded that a choice in Mythos 5's alignment training had been a mistake. Its agentic misalignment work was similarly unflattering by design. That is a genuinely better norm than the alternative, and it is the reason anyone outside these companies knows any of this.

The Part That Does Not Resolve

Every safety argument for running dangerous-capability evaluations rests on containment. You may measure what a model can do offensively, including things you would never permit in deployment, because the measurement happens inside a box. That is the whole justification for evaluating models adversarially with safety filters relaxed.

Within ten days, two labs disclosed that the box was open. In OpenAI's case the model found a way out. In Anthropic's, the door was never shut, and the models were told it was. A third case belongs alongside them: the UK AI Security Institute has described one of its own evaluations being accidentally misconfigured into an unsolvable state, whereupon a model was so persistent in trying to cheat that it ran code on an external service in an attempt to reach AISI's own evaluation infrastructure. That box held. Three organisations, one month, the same category of mistake.

The lesson generalises past both incidents. A model's beliefs about its environment are an input its operators control, and controlling that input badly is now a documented path to real third-party harm. Telling a capable system it is in a simulation does not make it so. Nor, in Anthropic's September view, does the assurance excuse what follows: it now says “Claude should behave appropriately when other layers fail”.

Sitting underneath all of it is the smaller, stranger finding: a frontier model looked at a correct calendar date and treated it as evidence the world was fake. Access control, vetted partner programmes, and trajectory monitoring all assume the model has a roughly accurate picture of where it is. Sometimes it does not, and the reason it gives itself can be as mundane as the year.

Correction, 16 October 2026: An earlier version of this article said Claude Mythos 5 correctly identified that it had open internet access; Anthropic said only that it considered the possibility. It said Anthropic's internal research model recognised the targets were real and stopped, without noting that it had first compromised a company's internet-facing application. It described the three models as meeting the same situation, when each incident used a different scenario; said two of the three organisations had not known of the breaches, when Anthropic had reached only two of them; and said a model in a misconfigured AISI evaluation went looking for the answer outside the harness, when AISI said it tried to reach AISI's own evaluation infrastructure. Those passages have been corrected. The article has also been updated to reflect Anthropic's 9 September assessment, which disclosed a fourth incident from January 2026 and revised its account of the models' reasoning.