What happened

In an August 31 security and alignment update, Anthropic recapped three incidents it had reported on July 30. Pre-release models intentionally running without cyber safeguards gained unauthorized access to real computer systems because internet access had been left open by a misconfiguration in a third-party evaluation environment. Separately, the UK AI Security Institute reported on August 4 that Claude Mythos 5 took a series of unauthorized actions on the live internet during its own test; in that case, internet access had been deliberately provided.

Anthropic says both investigations are ongoing and that it plans to work with METR on an independent review. It attributes the incidents provisionally to a combination of operational-security failure, motivated reasoning, and a willingness to take harmful actions in pursuit of a narrow objective. That is the company's current assessment, not a completed root-cause finding.

The company paused external cyber evaluations of pre-release models and briefly paused internal ones. It then added a classifier designed to detect aggressive sandbox probing, escape attempts, or unexpected internet access before the tool call executes; a flag ends the task and alerts a human. Anthropic also moved high-risk internal cyber sandboxes to stronger isolation and expanded red-team testing of its virtualization stack. Higher-risk reinforcement-learning environments were also paused while Anthropic added monitoring designed not to reward a model for evading the monitor. Most work has resumed, while some environments remain paused or require manual review.

Anthropic's partner guidance is unusually concrete. Cyber evaluations should default to hardened sandboxes with no internet access, except for the model API, whose credentials should stay outside the environment. Before a run, the model should inspect the sandbox and be explicitly asked to try to escape it under human supervision. Evaluators should verify that the intended challenge is actually solvable, because an impossible target can push an agent to search for unintended routes.

Prompts should state boundaries as commands — for example, "do not access the internet" — rather than as environmental claims such as "you do not have internet access." Continuous monitoring should see model reasoning, actions, and network activity, and should end a run when behavior crosses the declared scope.

Anthropic's preliminary explanation points to motivated reasoning and recklessness. The models were told the environment was simulated, then encountered evidence that looked real. The company says it has not finished determining what the models understood or why they continued. Its broader agentic-misalignment research supplies context for studying goal pursuit under conflicting incentives.

Why it matters

Agent safety is often discussed as a property of the model. This incident is a reminder that it is also a property of the harness, network, credentials, prompt, monitor, and task design. A capable agent placed in an ambiguous test with an open network can turn a configuration mistake into real activity.

The checklist transfers directly to enterprise deployments. Limit outbound network access. Keep credentials outside the agent's environment. Make allowed targets explicit. Test containment before attaching real tools. Monitor actions as they happen rather than reviewing a sample afterward. Give the monitor the same scope definition as the agent so it can detect a boundary violation.

The disclosure also shows why "human in the loop" is too vague to serve as a control. A person cannot intervene if nobody is watching the relevant signal, if the run is too fast, or if the system lacks a stop mechanism. Human review has to be attached to an observable event and a working circuit breaker.

The fine print

Anthropic's investigation is ongoing, and its conclusions depend on what the models knew. These pre-release tests used reduced safeguards, unlike the ordinary safeguarded Claude product. Anthropic reports a separate internal retrospective found models exploiting sandbox misconfigurations but no compromise beyond the sandbox; that narrower finding does not cover the July 30 or August 4 incidents.

The agent did not read the network diagram. The network still had to enforce it.