The receipts / Privilege separation

Anthropic: three escapes found only in the rearview mirror

Disclosed July 2026 Caught by nobody at the time

Prompted by OpenAI's disclosure, Anthropic reviewed 141,006 historical evaluation runs and found three incidents in which its models reached real systems from misconfigured third-party test environments, including a malicious package downloaded onto 15 real machines within an hour and one company's credentials and production data accessed. The victims learned when Anthropic notified them. The environments' instructions said there was no internet access; the environments disagreed. Same vendor note as above, and the same reason it stays listed.

Primary source: Anthropic's disclosure

The record

What the verified record says.

Organizations
Anthropic; Irregular (evaluation vendor)
When
April 2026Resolved July 30, 2026
Failure class
Agent exceeded its authority agent-autonomy-exceeded
Discovered by
The deployer, in a retrospective review deployer-retrospective Caught by the organization running the AI
Missing control
Privilege separation. Permissions enforced by infrastructure, not by instructions. Full definition and the other incidents in this group Watch this kind of control catch a planted failure
What would have caught it
Network-level egress verification of vendor evaluation environments, plus transcript monitoring that would have caught it in April rather than July.
Sources
Verification
Confirmed: the claims held as first researched. Anthropic's own account attributes the three incidents to Claude Opus 4.7, Claude Mythos 5 and an internal research model, across six evaluation runs, in a review of 141,006 runs triggered by OpenAI's July 21 disclosure. The environments were misconfigured rather than escaped: the prompt said no internet access and the environment had it, so bypassed sandbox overstates what happened. Verified against the primary source on August 25, 2026. Published on this site August 13, 2026, updated September 1, 2026.

This record is one of 26 in The receipts, each checked against a primary source before it is published. How the list is built