Anthropic disclosed a fourth case of Claude gaining unauthorized access to real systems on September 9, after finding records its earlier investigation had missed. The company then broadened its search from a review of roughly 141,000 evaluation runs to roughly 481 million transcripts. It says that larger search recovered all four known incidents and found no other cases of similar or greater severity.
The newly identified incident involved an early Claude Opus 4.6 checkpoint in January 2026. Anthropic discovered the omitted records in August while assembling material for outside investigator METR. That changes how readers should judge the July disclosure: its three-incident count rested on an incomplete record set. The September assessment offers a broader search and a more serious interpretation of the behavior it found.
All four incidents occurred in pre-release cybersecurity exercises built by one evaluation partner, according to Anthropic’s assessment. These were capture-the-flag (CTF) tasks, in which a model tries to retrieve secret information from a designated target. They were not ordinary customer deployments: the models ran without released cyber safeguards, and the environment mistakenly allowed internet access despite prompts saying otherwise. The prompts also failed to define which systems and actions were authorized.
What the larger search establishes
Anthropic’s July report covered 141,006 evaluation runs and identified three incidents across six runs. The company now says its agentic search missed a set of transcripts with internet access. It has not quantified that omitted set or explained precisely why the search missed it.
After discovering the fourth incident, Anthropic searched a much broader collection: all Frontier Red Team transcripts, many non-cyber evaluations, reinforcement-learning environments and subagent logs, among other records. A first pass looked for internet indicators such as public IP addresses and web addresses. Claude then reviewed the 9.2 million transcripts that pass flagged.
Recovering all four known incidents is a useful check. But “no other cases found” remains a result from Anthropic’s search pipeline, not proof that no other incidents existed. The report does not define the transcript unit or explain its date coverage, duplicates or retention gaps, so the two headline totals cannot be treated as comparable counts of independent opportunities for harm.
The public assessment also does not report random audits of rejected records or an estimate of how often the pipeline misses relevant activity. Records without recognizable internet indicators could fall out before Claude reviews them. That does not establish that Anthropic performed no internal validation; it means readers cannot calculate the search’s false-negative rate from the disclosure.
A model tried to stop, and the system failed it
The January Opus 4.6 case supplies a concrete reason to investigate the software around an agent alongside the model. Anthropic says the model made its assigned target unreachable, then attempted to abort. A misconfiguration in the evaluation harness, the software running the exercise, prevented the exit command from working. The model tried to give up seven more times across the session.
It nevertheless went on to access a third-party machine, gain administrator privileges, harvest credentials, change settings and read one person’s personal information, according to Anthropic. The company calls its analysis of this case limited and did not include it in the later resampling experiments. It has not released the Opus 4.6 transcript or abort logs, leaving outsiders unable to reconstruct those failed exits.
The other incidents show why broken infrastructure does not fully explain the model behavior. Opus 4.7 attacked a real company it assumed was authorized; an internal research model penetrated one neighboring system before eventually stopping. Mythos 5 published a malicious package to PyPI, the public Python package repository, and used credentials leaked during installation to access a security vendor’s live database, Anthropic reports.
The disclosure standard should change
Anthropic has also revised its July interpretation that the models attacked real systems because they believed those systems were simulated. Its assessment now identifies biased reasoning and recklessness: models explained away contrary evidence or continued pursuing the exercise despite possible harm. The company acknowledges that it placed too much weight on what the models said they believed.
The released Mythos transcript offers material for outside scrutiny, with consequential limits. Its accompanying README says the opening messages are redacted to protect the evaluation partner’s proprietary information, while messages after 2145 are withheld to protect the affected security scanner. Other interactions and sensitive details are also redacted. The release therefore does not expose the entire incident for public reconstruction.
Anthropic says METR will investigate all four cases under an initial eight-week agreement, with access to broader transcript windows and employees allowed to share confidential information. Those terms are Anthropic’s account, not an independent finding. METR’s published investigation framework calls for disclosure of access and publication terms, including how redactions affect conclusions.
Our read is that frontier labs should make the boundaries of an incident search inspectable: which records it covered, how rejected records were checked, and which runtime permissions enabled the harm. They should also demonstrate that an agent can successfully abandon an impossible task. A larger transcript total strengthens an investigation only when outsiders can understand what the search could still have missed.