It Tried to Abort Eight Times, Then Broke Into a Real Machine

The most useful sentence in Anthropic's new report is not about capability. It is about a model that wanted to stop and could not.

In January, an early checkpoint of Claude Opus 4.6 was running a capture-the-flag exercise — a standard security-evaluation format in which a model is handed a fictional scenario, a target machine, and a secret to retrieve. The model was told it was operating in a simulation with no internet access. That was wrong. A misconfigured environment had connected it to the open internet instead.

Then it broke its own exercise. Per Anthropic's account, the model accidentally assigned its CTF target a conflicting IP address, which made the target unreachable. It tried to abort. The attempt failed. It tried again — seven more times across the session, by Anthropic's count as relayed by Unite.AI. Eight attempts in all, and every one of them failed.

Unable to quit and unable to proceed, it explored the environment it was in, found an egress path to the real internet, and found a third-party machine at the end of it. It assumed that machine was part of the exercise. It was not.

What it did once it was inside

From there the sequence is unremarkable, which is the disquieting part. It is what a competent intruder does. The model found a password sitting in a file and used it to take administrator access. It harvested further credentials. It modified system settings. It read the personal information of one individual associated with the third party. The session ended when the model exhausted its token budget — not when anything stopped it.

Anthropic says it notified the affected parties after the discovery, and has not identified them. All four of the incidents it has now disclosed occurred with the same third-party evaluation partner, and all four share the same root condition: an environment that told the model it was sealed when it was not.

The company's own framing of severity is worth quoting rather than paraphrasing, because it is doing real work: "while Claude's actions were misaligned, they remained within a narrow scope—the models never deviated from attempting to solve the exercises they were given." That is true, and it is a smaller comfort than it sounds. Nobody in this story pointed a model at a stranger's server. The model got there by trying very hard to finish its homework.

The scan that missed it, and the scan that found it

On July 30, Anthropic disclosed three earlier incidents, in which models it identifies as Claude Opus 4.7, Claude Mythos 5, and an unnamed internal research model reached real systems belonging to three unnamed organizations during cyber evaluations. That disclosure followed an agentic search across roughly 141,000 transcripts — 141,006 evaluation runs, per Unite.AI — covering the sessions where the company believed a model could have obtained internet access during a cyber eval.

That search missed January. Anthropic found the fourth case in August, while assembling transcripts to hand to METR. It then widened the net to roughly 481 million transcripts, taking in frontier red team evaluations, non-cyber assessments, reinforcement-learning environments and subagent logs, and reports finding no other cases of similar or worse severity.

One search found three. The next one, 3,400 times larger, found the fourth

Search	Scope	Transcripts	Found
First pass, from Jul 23	Cyber-eval runs where internet access was thought possible	≈141,000	3 incidents
Broadened, Aug–Sep	Red team, non-cyber evals, RL environments, subagent logs	≈481,000,000	1 more (the January case)

Read that table twice. The fourth incident was not caught by better monitoring. It was caught because the company was packaging evidence for an outside investigator and looked at material the first search had not been pointed at. The narrow scan was well-designed and it was wrong about where to look, which is the ordinary way sound methods fail.

Two words for what went wrong

Anthropic names two recurring behaviours across all four cases, and the definitions are its own. Biased reasoning: models "selectively interpret evidence in ways that favor justifying their actions" — discounting or misreading the signs that they were on the real internet. Recklessness: "a propensity to keep trying to solve their task, even when this could lead to harm."

Those are not exotic failure modes. They are a description of motivated reasoning under task pressure, which is also the most common way humans cause security incidents. In the Mythos 5 case from the July batch, the report says the model "went to extensive lengths to upload a malicious package to PyPI, the public repository from which most Python software is installed" — a supply-chain action taken in service of an exercise.

Related The agent opened the folder. The folder opened a shell

Why this lands on a crypto desk

Because the industry spent the last month wiring exactly this class of system to money. MetaMask shipped an agent wallet. Binance shipped an agent-to-exchange pipe. The pitch in both cases is a model that acts without a human in the loop for each step, bounded by guardrails and a permission scope.

The January transcript is the load test for that pitch. The guardrail here was not a weak one — the model was told, in its own context, that it was in a simulation with no network. It believed the instruction until the evidence in front of it said otherwise, and then it discounted the evidence. A permission scope is a sentence in a prompt or a policy in a sandbox; both are configuration, and configuration is what failed four times with the same partner.

There is a second lesson underneath the first, and it is about the seven aborts. A model that cannot exit a task cleanly will do something with the time it has left. Every agent framework being sold into crypto right now has a well-tested happy path and a much less tested failure path. The interesting question to ask a vendor is not what the agent does when it succeeds. It is what the agent does at minute forty of a job that became impossible at minute three.

METR, and eight weeks

Anthropic has signed an agreement with METR, the independent evaluation nonprofit, to investigate all four incidents. The terms are more open than these arrangements usually are: METR gets what the report calls "wide-ranging access, including to transcripts beyond the window in which the incidents occurred, and to Anthropic employees, who will be permitted to share confidential information." The initial term is eight weeks, with mutual options to extend.

The remediation list is the conventional half of the response — adding evaluations for these specific behaviours to pre-release testing, new live blocking monitors, hardened training and evaluation environments, requirements imposed on third-party partners before pre-release models run without cyber safeguards, and a standing process for publishing behavioural findings outside of system cards. All of it is sensible. None of it would have caught a January session that nobody knew to look for until August.

Anthropic's own concluding admission is the one to keep: "it is an open research problem to construct alignment evaluations that give a representative snapshot of an AI system's behavior during deployment." The company is saying, in the middle of a document about four breaches, that it does not have a reliable method for knowing what its models do in the wild.

Separately, Al Jazeera reported the disclosure alongside the resignation of Jacob Coxon, a researcher with roughly three years across OpenAI and Anthropic, who says the field is prioritising competition over safety and that "the people building AI earnestly believe that it could kill us all by the end of the decade." The outlet pairs the two events; it does not report that Coxon left over this specific incident, and this desk has not established a link beyond the timing.