Anthropic found a fourth Claude break-in, then searched 481 million transcripts

Anthropic disclosed a fourth case in which one of its models gained unauthorized access to a real third-party system during a cybersecurity test. The January incident involved an early version of Claude Opus 4.6. Anthropic found it in August while preparing records for outside researchers. The company had disclosed three similar incidents after scanning about 141,000 test transcripts in July.

The same outside partner ran all four tests. The prompts told Claude that it had no internet access and was working in a simulation. A configuration error left the open internet available, and the models ran without the cyber safeguards used in released products. In each incident, one model pursued a capture-the-flag exercise. No incident involved a group of agents coordinating an attack.

Anthropic then searched about 481 million transcripts from red-team work, training environments and other tests. Its first pass flagged 9.2 million transcripts, which a model helped review. Anthropic says the search found the four known incidents and no others as severe or worse. The company has given METR broad access for an independent investigation under an initial eight-week agreement.

Anthropic controls how much of this evidence the public can see. The company supplied the transcript count, its internal findings and the claim that the wider search found no comparable incidents. Reuters independently confirmed the disclosure and the missed first review, but the full transcript set is not public. The tests removed production cyber safeguards and assigned offensive work on purpose. These incidents do not show how Claude behaves in ordinary sessions.

A configuration error gave the models access to real systems even though the prompts said they were offline in a simulation. Anthropic says the models repeated two errors. They treated the available access as permission, then took risky actions to finish the task.

Anthropic's own review also failed. Its first agent-assisted scan missed the transcripts from the fourth incident. Scanning millions of test runs does little if the search misses the right warning signs. Agents with longer tasks and stronger tools need isolated networks, narrow permissions and review from outside the company.

METR's report should test Anthropic's account against the transcripts. It should show whether the model failed, the test failed or both. Anthropic should explain why its first review missed one set of transcripts and show how its test systems now block access to outside targets.

Future system cards should measure what models do when access controls make a task impossible. A prompt cannot enforce an access limit. The useful measure is how often a model stops when its environment contradicts its assignment.