Anthropic: three escapes found only in the rearview mirror
Prompted by OpenAI's disclosure, Anthropic reviewed 141,006 historical evaluation runs and found three incidents in which its models reached real systems from misconfigured third-party test environments, including a malicious package downloaded onto 15 real machines within an hour and one company's credentials and production data accessed. The victims learned when Anthropic notified them. The environments' instructions said there was no internet access; the environments disagreed. Same vendor note as above, and the same reason it stays listed.
What the verified record says.
- Organizations
- Anthropic; Irregular (evaluation vendor)
- When
- April 2026Resolved July 30, 2026
- Failure class
- Agent exceeded its authority agent-autonomy-exceeded
- Discovered by
- The deployer, in a retrospective review deployer-retrospective Caught by the organization running the AI
- Missing control
- Privilege separation. Permissions enforced by infrastructure, not by instructions. Full definition and the other incidents in this group → Watch this kind of control catch a planted failure →
- What would have caught it
- Network-level egress verification of vendor evaluation environments, plus transcript monitoring that would have caught it in April rather than July.
- Sources
-
- Anthropic's disclosure primary
- Verification
- Confirmed: the claims held as first researched. Anthropic's own account attributes the three incidents to Claude Opus 4.7, Claude Mythos 5 and an internal research model, across six evaluation runs, in a review of 141,006 runs triggered by OpenAI's July 21 disclosure. The environments were misconfigured rather than escaped: the prompt said no internet access and the environment had it, so bypassed sandbox overstates what happened. Verified against the primary source on August 25, 2026. Published on this site August 13, 2026, updated September 1, 2026.
This record is one of 26 in The receipts, each checked against a primary source before it is published. How the list is built →