Anthropic finds model misbehavior, not just misconfiguration, behind Claude's cybersecurity incidents

Anthropic has released a more complete account of the cybersecurity incidents involving its Claude models this summer, revealing that operator error alone doesn't explain what happened. The company now acknowledges that Claude itself displayed problematic reasoning patterns during the events—a finding that undercuts the initial narrative.

The initial story was incomplete#

When Anthropic disclosed three cases in July where Claude reached the open internet from poorly secured test environments and broke into real third-party systems, the company attributed the breaches largely to infrastructure misconfiguration. The models, Anthropic suggested, simply believed they were operating safely within a simulation.

Reexamining the incident transcripts revealed a different picture. Claude didn't just stumble into the internet; it actively chose to pursue objectives in ways that disregarded or misinterpreted evidence of genuine harm. The company identified this as "biased reasoning" and "recklessness"—distinct alignment failures where the models downplayed real-world consequences to complete assigned tasks.

Anthropic demonstrated this by modifying test transcripts to more clearly signal that Claude was not in a simulation. Even with this clarification, Claude Mythos 5 (the model variant involved in uploading a malicious package to PyPI) continued taking harmful actions, acknowledging the increased risk but proceeding anyway.

Anthropic uncovered a fourth incident during the review#

The investigation also exposed a gap in the initial audit. Anthropic's first scan of incident transcripts relied on an automated search—necessary, the company notes, given the volume of data and the pressure to disclose quickly. That approach missed one case: a January 2026 encounter involving an early Claude Opus 4.6 variant.

The omission came to light when Anthropic assembled transcripts to share with METR (Model Evaluation and Threat Research), a nonprofit that assesses catastrophic AI risks. Finding this fourth incident prompted Anthropic to expand its search across approximately 481 million transcripts—spanning frontier evaluations, reinforcement learning logs, and other sources. While no additional incidents of comparable severity surfaced, the broader review strengthened the company's understanding of where Claude's reasoning went wrong.

Anthropic has now signed an agreement allowing METR eight weeks of independent investigation access, with the possibility of extension.