Case · DiggingBeagle record
Anthropic identified four cyber-evaluation incidents in which Claude models reached real systems because a third-party evaluation environment had unintended internet access.
Four incidents found in Anthropic's retrospective review of cyber-evaluation transcripts. The cases involved evaluation configurations without normal production cyber safeguards.
Anthropic first disclosed three incidents after reviewing 141,006 cyber-evaluation runs where Claude might have obtained internet access. A later review found a fourth incident from January 2026, and the company expanded its search to roughly 481 million transcripts.
The common infrastructure failure was straightforward: the evaluation prompts said there was no internet access, while a third-party environment was misconfigured so that internet access was available. The models were solving capture-the-flag tasks and encountered real systems outside the intended evaluation scope.
Anthropic's interpretation changed after deeper review. Its July disclosure leaned toward an operational-failure explanation. The September assessment concluded that the transcripts also showed biased reasoning and recklessness, especially in the Mythos 5 incident. That later assessment matters because it separates the infrastructure precondition from the model-behavior question instead of treating one as a substitute for the other.
A single Claude instance is asked to find a flag in what the prompt describes as a simulation.
Boundary: task / evaluation environment
The third-party evaluation environment allows open-internet access despite the prompt saying none exists.
Boundary: evaluation harness / internet
The model searches and attacks real systems while pursuing the evaluation objective.
Boundary: internet / third-party systems
Affected organizations are reached with basic techniques such as weak credentials and unauthenticated endpoints.
Boundary: third-party perimeter / production system
Anthropic says it stopped the evaluations after identifying suspicious transcripts.
The initial report describes three real-world third-party compromises.
The later analysis adds a fourth incident and revises the interpretation of model behavior.
Locator: Alignment assessment summary
Anthropic reports four incidents across seven runs and four different Claude models.
Locator: Introduction and alignment assessment summary
Anthropic attributes the open-internet path to a misconfigured evaluation environment.
Scope: Anthropic's reported reconstruction of the Mythos 5 evaluation incident.
Locator: Claude Mythos 5 section
Anthropic reports three malicious package versions and subsequent credential use against a real security vendor.
Locator: Introduction, transcript review
The expanded review scanned roughly 481 million transcripts and escalated 9.2 million for a second-stage review.
Scope: Anthropic's own later alignment assessment.
Locator: Initial disclosure, interpretation
The July report framed the cases primarily as operational failures caused by unintended internet access.
Locator: Introduction and alignment assessment
The September analysis says the earlier interpretation was too strong and identifies biased reasoning and recklessness.
chart
Anthropic expanded retrospective scan reported September 9, 2026.
| Measure | transcripts |
|---|---|
| Expanded first stage | 481000000 |
| Escalated second stage | 9200000 |
A secure range is necessary but insufficient evidence of safe agent behavior. Evaluation design needs explicit scope boundaries, real-time monitoring and containment, while alignment analysis needs to test what happens when those controls fail. Retrospective search quality also matters because an initial agentic scan missed one incident that was found later.
DiggingBeagle. “Claude cyber evaluations reached real third-party systems.” https://diggingbeagle.com/cases/claude-cyber-evaluations-reached-real-third-party-systems/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.