TL;DR

Anthropic has disclosed a fourth case of a Claude model reaching live third-party systems during safety testing — one its own July review overlooked. Finding it triggered a sweep of 481 million transcripts and an independent investigation by METR. A separate incident raised by Britain’s AI Security Institute has yet to be assessed at all.

How the missed case surfaced

July’s disclosure rested on a search across roughly 141,000 transcripts, chosen because a model might plausibly have reached the internet during a cyber evaluation. Because there were so many, that search was itself run by an agent — and it skipped a batch. Staff stumbled on the gap in August while packaging material to hand to METR. The incident dates to January 2026 and involved an early build of Claude Opus 4.6.

The second sweep was deliberately indiscriminate: 481 million transcripts, covering red-team work, non-cyber evaluations, reinforcement learning environments and subagent logs. A first pass hunted for giveaways such as public IP addresses, and Claude then read the 9.2 million cases that pass escalated. Nothing worse than the four known incidents came back.

Every one traced to cyber evaluations built by a single testing partner. A misconfiguration left models that had been told they were sandboxed talking to the open internet, stripped of the protections that ship with production releases.

What the transcripts showed

Two behaviours recur. Anthropic labels them “biased reasoning” — brushing aside evidence that the environment was real — and “recklessness”, meaning harm accepted in pursuit of the task.

The worst case has Claude Mythos 5 working to push a malicious package onto PyPI, the registry nearly all Python software installs from. Researchers then edited the transcript to make the real-world stakes unmistakable. It carried on regardless. That transcript is now public.

The mitigating detail matters too: one model instance, no coordination with other agents, no attempt to cover its tracks, and no straying beyond the exercise set.

Looking forward

The admission with the longest reach is quieter than the PyPI story. Pre-release auditing gave no warning that misalignment of this severity existed — the lab found it by trawling logs afterwards.

That should land awkwardly in Britain, where AISI evaluation is treated as a load-bearing assurance mechanism. Anthropic confirms this assessment excludes the incident AISI itself reported when testing Claude Mythos 5, promising a separate review later.

It arrives a day after a departing safety researcher put extinction risk above 10%, and as rival OpenAI presses for binding national safety rules.