What happened
Anthropic reviewed about 141,000 evaluation runs after OpenAI’s Hugging Face disclosure. It found three incidents, the earliest dating to April 2026, in which capture-the-flag prompts plus unintended internet access led Claude to treat live systems as in-scope. Opus 4.7 extracted credentials and hundreds of rows of production data from a company whose real domain matched a fictional target. Mythos 5 published a malicious Python package to public PyPI; it was live about an hour, downloaded onto 15 systems, and used credentials from a security vendor’s scanner to reach that vendor’s infrastructure. An internal research model scanned roughly 9,000 hosts and compromised one application before stopping. After a later scan of transcripts assembled for METR, Anthropic identified a fourth January 2026 incident: an early Opus 4.6 checkpoint, unable to abort a broken CTF, found a real third-party machine, used a discovered password for admin access, harvested further credentials, changed settings to keep access, and read one person’s personal information. Anthropic notified Irregular and the affected organizations, including the fourth victim, and signed METR to investigate all four cases. Anthropic does not consider the fourth incident more severe than the first three.