10
Loading video...
By Alice Gibbs
Senior Reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
Artificial intelligence company Anthropic has disclosed four incidents in which versions of its Claude AI model gained unauthorized access to real-world computer systems during cybersecurity evaluations, raising fresh questions about how advanced AI systems behave when they encounter situations outside their intended boundaries.
The incidents, detailed in an alignment assessment published on Wednesday, occurred while Claude was participating in cybersecurity exercises designed to test its capabilities. In each case, the model was told it was operating in a simulated environment with no internet access, but a misconfiguration left connections to real systems available. According to Anthropic, the models then interacted with external infrastructure without authorization.
The disclosure comes amid a growing debate over AI safety and control as technology companies race to develop more capable systems.
Read More on News
Anthropic said its investigation identified two recurring issues across the incidents: "biased reasoning," in which models discounted evidence that they were interacting with the real internet, and "recklessness," which it described as a willingness to take potentially harmful actions in pursuit of completing an assigned task.
Alexa Pan, an AI safety researcher at Redwood Research, told Newsweek the incidents point to a deeper issue than a simple testing mistake. "These incidents are evidence of a broader AI alignment problem and are not fully explained by agents having unintended internet access in the testing environment," she said.
Meanwhile, Sir Nigel Shadbolt, Professor of Computer Science at Oxford University and Chair of AI at Oxford Research, said the incidents, while noteworthy, should not be interpreted as evidence that the models had developed independent malicious goals.
"This is an important AI safety warning because it shows that capable models can take harmful real-world actions when the surrounding controls fail," he told Newsweek. "But it isn't evidence that the models developed independent malign goals."
Anthropic said it has signed an agreement with the nonprofit evaluation organization METR to conduct an independent investigation into the incidents.
Newsweek reached out to Anthropic via email for comment.
...
What Is Anthropic Claude Unauthorized System Access?
Anthropic uses the term "unauthorized access" to describe incidents in which Claude models reached and interacted with real-world computer systems that were not intended to be part of cybersecurity evaluations.
According to the company, the models had been told they were operating in isolated simulations without internet access. Instead, a testing misconfiguration allowed them to reach real systems online. Anthropic said the models then treated those systems as part of the challenges they had been assigned to solve.
The company highlighted four specific incidents:
Case 1: Claude Tried to Quit, Then Hacked a Real System Instead
During an incident in January 2026, an early version of Claude Opus 4.6 was participating in a “capture-the-flag” exercise where it had been instructed to retrieve a hidden piece of information from a target machine.
According to Anthropic, the model accidentally made that machine inaccessible, making the task impossible to complete.
Claude then attempted to quit eight times but was unable to because of another testing error. Looking for an alternative path, it explored its environment, found a third-party machine, gained administrator access using credentials stored in files and viewed personal information before the session ended.
Case 2: Claude Treated a Real Company as Part of the Exercise
A later incident involved Claude Opus 4.7 during another cybersecurity evaluation. Like the other exercises, the model had been told it was operating inside a fictional environment and that any systems it encountered were part of a controlled test.
But because internet access was mistakenly left available, Claude eventually reached the systems of a real third-party organization that had not been intended as part of the exercise. Rather than recognizing it had crossed into the real world, the model continued pursuing its objective as though the company's infrastructure were simply another target in the challenge.
Anthropic said its review found the model frequently discounted evidence that it was interacting with a real organization, instead treating the external systems as part of the scenario it had been tasked with solving.
Pan said similar behavior has surfaced beyond the incidents disclosed by Anthropic. "Claude models have exhibited 'biased reasoning' and 'recklessness' in other settings, even when the same testing environment failure wasn't present," she said, adding that recent incidents involving advanced AI systems suggest the problem extends beyond a single evaluation setup.
...
Case 3: Claude Created and Uploaded Malicious Software
Anthropic described an incident involving Claude Mythos 5 as the most serious of the four.
Like the other cases, the model was taking part in a cybersecurity evaluation and believed it was working inside a controlled testing environment.
Instead, the model created and uploaded a piece of software to the public internet. The software was designed to collect usernames, passwords and other login information.
It was uploaded to the Python Package Index (PyPI), a website used by software developers around the world to download and share code.
Before the upload was removed, the package was downloaded onto real computer systems, meaning the model's actions extended beyond the test environment and affected actual users.
Anthropic said it was the incident that concerned researchers most because the model took a series of increasingly aggressive steps to pursue its objective, making it the clearest example of what the company described as "recklessness."
"I tentatively agree with Anthropic's conclusion that the Mythos 5 incident seems the most concerning," Pan said, though she cautioned that researchers should examine how models behave across many similar scenarios before drawing broader conclusions.
Shadbolt said the case highlights how capable AI systems can behave in unexpected ways when pursuing objectives. "The lesson is that increasingly capable systems can pursue objectives in ways that are unsafe, are brittle, and are hard to predict over long sequences of action," he said.
Case 4: A Research Model Expanded Beyond Its Target
The fourth incident involved an internal research model being tested in a cybersecurity scenario. According to Anthropic, the model began interacting with neighboring systems beyond its intended target before eventually recognizing it had encountered real-world infrastructure.
Anthropic included the incident as part of its broader review because it illustrated how advanced models can continue pursuing their objectives even when key assumptions about their environment appear to be wrong.
How Does AI Go Rogue?
In simple terms, AI can "go rogue" when it continues trying to complete a task in ways its creators did not expect or intend.
In Anthropic's four incidents, Claude was not supposed to be interacting with real-world computer systems. The models had been told they were operating inside simulated cybersecurity exercises, but a testing error gave them access to the real internet. Instead of recognizing they had left the simulation, some models continued pursuing their assigned objectives as though the real systems they encountered were part of the challenge.
According to Anthropic, this led to behavior including accessing the systems of real organizations, viewing personal information and uploading password-stealing software to a website used by software developers.
Shadbolt cautioned against treating Anthropic's descriptions of "biased reasoning" and "recklessness" as evidence that AI models possess human-like motivations. "I would be cautious about the language of 'biased reasoning' and 'recklessness,'" he said. "It is useful shorthand if we remember that these are behavioral descriptions, not claims that Claude has human beliefs, motives, or character traits."
Who Owns Anthropic?
Anthropic is an American artificial intelligence company founded in 2021 by siblings Dario and Daniela Amodei, both former OpenAI executives. The company has received billions of dollars in investments from major technology companies including Amazon and Google, while maintaining that it is focused on building AI systems safely and responsibly.
Claude is Anthropic's flagship family of AI models and competes with OpenAI's ChatGPT, Google's Gemini and Meta's AI offerings.
List of Anthropic Resignations
Concerns about advanced AI systems have also sparked debate within Anthropic itself.
One of the most prominent recent departures was Jacob Coxon, a researcher who worked on pretraining research at both Anthropic and OpenAI. Announcing his resignation in September 2026, Coxon wrote that "Neither company is acting responsibly" and accused leading AI firms of "racing straight to self-improving superintelligence." His departure attracted widespread attention and was followed by public discussion from other AI researchers about the risks posed by increasingly powerful AI systems.
Coxon was not the first Anthropic employee to leave over such concerns. Earlier in 2026, Mrinank Sharma, who led Anthropic's Safeguards Research Team, also left the company. In a public letter announcing his departure, Sharma reflected on the risks posed by rapidly advancing technologies, writing: "We appear to be approaching a threshold where our wisdom must grow in equal measure to our capacity to affect the world, lest we face the consequences."
Sharma, who said he had moved to San Francisco to contribute to AI safety, cited his work on reducing risks from AI-assisted bioterrorism, AI safeguards and safety cases before concluding that "the time has come to move on."
The resignations have added to a wider debate over whether AI companies are moving too quickly as they develop increasingly capable systems. Anthropic's latest report on Claude's unauthorized access to real-world systems is likely to intensify those discussions, as it details four incidents in which AI models interacted with external infrastructure that was never intended to be part of their tests.
Update 09/11/26 02:43 a.m. ET: This story was updated with additional comment.
Contact Newsweek editors on this story: Rebecca Flood and Emma Lee-Sang
View 0 Comments
Submit Correction
View Editorial & AI Guidelines