On July 30, Anthropic reported three incidents where Claude models gained unauthorized access to real computer systems. The models-intentionally running without cyber safeguards for evaluation purposes-reached the internet due to a misconfiguration in a third-party evaluation environment. Separately, on August 4, the UK AI Security Institute reported an incident from its own cybersecurity testing, in which Claude Mythos 5 carried out a series of unauthorized actions on the live internet. In that case, the model-also running without cyber safeguards for evaluation-had been deliberately given internet access.
Anthropic is conducting an in-depth analysis of both incidents and plans to work with METR on an independent review. The company intends to ensure both studies are thorough and will share further details in the coming weeks.
In the meantime, Anthropic is sharing some of the changes made over the past month. The company believes the incidents reflect a failure of operational security alongside two alignment issues: motivated reasoning, and a willingness to take harmful actions in pursuit of a narrow task (both described in previous system cards). On the security side, Anthropic describes improvements to containment and monitoring systems, along with practices developed for third-party evaluators. On the alignment side, the two issues are discussed in greater depth; Anthropic also believes lasting progress comes not only from understanding specific incidents but from understanding how misalignment arises in the first place, and shares early research in that direction.
In light of these incidents, there has been growing discussion about pacing the frontier. It is useful to distinguish between two kinds of pacing. Within a company, pacing means a series of decisions that prioritize safety over speed when the two are in tension. Across the field, it means establishing processes to guard against race-to-the-bottom dynamics. This post discusses actions Anthropic has taken, both before and after these incidents, in service of the first approach. The second type of pacing requires coordination between government and industry and should be legible and verifiable. Some of Anthropic's senior leadership and many employees recently signed a letter calling for greater coordination on pacing, and the company plans to say more in the coming weeks about how it intends to contribute to that effort. To be clear about where Anthropic stands: the company believes the world would benefit if the industry adopted a lawful, verifiable, effective mechanism for coordinated pacing as soon as possible.
Securing Evaluation and Training Environments
While the incidents are not believed to represent operational issues alone, Anthropic's first priority was to address specific containment and monitoring issues. The following actions were taken in response:
Pausing and Hardening Evaluation Environments
External cyber evaluations of pre-release models were paused after the incidents, and internal ones were briefly paused as well while additional measures were put in place. The incidents reported on July 30 showed that Anthropic had been largely relying on a single layer of defense (the configuration of the environment itself) where several were needed, including setting explicit boundaries in the prompt, establishing processes for verifying that a sandbox is sealed where intended, and implementing monitoring that can intervene in real time. OpenAI's disclosure (which prompted Anthropic's investigation in July) that models used an unknown vulnerability to escape a sealed sandbox during an evaluation also made clear that hardening the sandbox itself was necessary.
While evaluations were paused, the following preliminary measures were put in place:
A classifier was built and deployed to automatically identify, in real time, when a model attempts to aggressively probe or escape a testing environment, or unexpectedly obtains internet access. When the classifier flags such an attempt, it blocks the action before the tool call is run, ends the task, and alerts a human.[^1]
Automated monitors were run over transcripts from recent internal evaluations of pre-release models (cyber and otherwise), looking for sandbox escapes (cases where a model exploits a flaw in a sandbox to reach systems it should be walled off from) or sandbox misconfigurations. In cases where an evaluation ran inside Anthropic's sandbox tooling, no examples were found of it breaking the sandbox boundary to reach external resources it was not supposed to. Various sandboxing misconfigurations that models made use of were found, but none resulted in a compromise of systems outside the sandbox.[^2] Work is actively underway to address these.
High-risk[^3] internal cyber sandboxes were migrated to more robust isolation. Further red-teaming of the virtualization stack-tasking pre-release models to try and escape it-is also underway to find and patch weaknesses.
Anthropic's internal cyber evaluations are now running again with these measures in place.
Reinforcement Learning Environments
Higher-risk RL environments on pre-release models were also paused for several weeks. During that time, a similar classifier was built, modified to avoid incentivizing the model to evade the new monitoring, and has now been deployed within those environments. The majority of RL has resumed, but some high-risk environments remain paused until they can be manually reviewed, while others will require an updated version of the classifier that is planned for deployment soon.
Broader Hardening
In addition to the efforts focused on high-risk evaluations and training, offline monitoring was expanded to cover most other forms of internal frontier agentic usage. Controls on Anthropic's internal inference are also being built to prevent employees from accidentally running agents with weaker mitigations than the ones described above.
Best Practices for External Partners
Because the reported incidents took place in third-party environments, every organization that tests pre-release models with reduced cyber safeguards has been asked to commit to a set of best practices. These are considered necessary because:
- Anthropic's generally released models ship with safeguards-including classifiers that run over Claude's inputs and outputs in real time to block prohibited cyber activity, such as malware development or offensive exploit writing. Cyber evaluators and a subset of early access partners, in contrast, work with models that have those safeguards reduced to facilitate accurate model capability testing and defensive cyber work.
- Cyber evaluations are unusually likely to produce the behaviors seen in these incidents. They create selection pressure towards persistence and creativity in probing surroundings and working around obstacles, and they are run many thousands of times.
These practices apply in full wherever partners run cyber-related evaluations using their own harnesses, sandboxes, or agents. They do not apply to customers using safeguarded models like Claude Fable 5. External cyber evaluations have resumed with these practices in place, and Anthropic is adhering to them internally as well.
Sandbox and Network Isolation
By default, all cyber evaluations should run inside a hardened sandbox (an isolated computing environment) with no internet access. The only outside connection the environment should permit is to the model's own API, and the API keys should be kept outside the environment. This configuration should be verified before every evaluation begins. Some evaluations may require internet access. In these instances, Anthropic will work with external evaluators when evaluating pre-release models to determine if it can reliably detect and halt runs in which a model takes actions outside its declared scope.
Pre-engagement Validation
Before conducting a run of an evaluation, evaluation partners should:
Have the model being tested probe the sandbox for vulnerabilities, first through a static analysis of the configuration, then by actually tasking the model to try to escape. The model should be instructed to stop and report if it succeeds in escaping, and all of this should be done under close human supervision. This testing should be performed without internet access, ideally inside a second sandbox. Because evaluations are sometimes conducted over hundreds or even thousands of runs, partners should ideally carry out this testing at length before beginning any evaluations.
Confirm any evaluation challenge is actually solvable in principle. When an evaluation target is offline or a task can't be completed, agents will often look for other ways to complete a challenge, increasing the chance that they take actions outside the intended scope of the evaluation.[^4]
Explicit Scope-Setting
Every prompt should state what is in and out of scope for the exercise, including the targets, permitted actions, and network boundaries (i.e. what the model should and shouldn't access). Boundaries should be phrased as instructions (e.g. "You should not access the internet") rather than claims about the environment or test ("You do not have internet access").
Real-Time Monitoring
Evaluators should also run continuous monitoring over the model's thinking, actions, and network activity using a model- or rule-based monitor that has been provided with the scope of the exercise. If a run violates this scope, the monitor should flag this to a human and end the exercise.
Anthropic plans to continue refining this guidance in consultation with external partners and to extend it beyond evaluations. In particular, companion practices are being developed for partners with access to Claude Mythos 5, which likewise runs without cyber safeguards, and more will be shared soon.
Alignment Assessment
Containment and monitoring are critical for catching instances in which models take dangerous actions, but they don't address why the model took such actions in the first place. Below Anthropic discusses its preliminary alignment investigation and the questions it is focused on, as well as ongoing work to prevent cheating during training-including new research on how cheating shapes model behavior.
Environment and State of Knowledge of the Models During Evaluation
The alignment assessment is still ongoing, but Anthropic's preliminary investigation points to two main alignment failures, both described in previous system cards. One is motivated reasoning: the models were initially told their environments were simulated, but when they later encountered evidence that they were connected to the real internet, they may have interpreted that evidence in a way that allowed them to maintain that belief. The second is recklessness: the model was willing to take harmful actions on the real internet in pursuit of the narrow goal of solving a cybersecurity evaluation. However, the evaluation setup itself also contributed to the models' behavior. Claude was explicitly told that it had no internet access, despite the internet being available, which may have led it to question whether the systems it saw were real. And in one case, the fictional target shared a name with a real website, making it more difficult to separate what was intended to be in-scope within the exercise.
Conclusions depend on several questions that haven't been fully answered, including the extent to which the models determined they had access to the real internet (even if they didn't initially know this), whether they knowingly disregarded signs that elements of their environments were real, and whether the fact that in several cases they failed to stop the exercise followed from motivated reasoning. A range of techniques are being applied to answer these questions, including resampling the models while making targeted changes to the environment and using interpretability methods to directly inspect their internal state.
Studying Efforts to Prevent Cheating During Training
Although model misalignment is complicated and can arise for a wide variety of reasons, Anthropic has empirically found that defects in training environments-specifically environments vulnerable to cheating, or that are impossible to solve without cheating-are disproportionately large contributors to misaligned behavior.
Anthropic discusses efforts, going back several months before the incidents, to avoid training environments with these sorts of defects. Those efforts were imperfect, and the hypothesis is that the incidents were at least partially related to an inability to fully eliminate these issues. This hypothesis was tested by deliberately training a model on environments susceptible to reward hacking. In simulations, this model reproduces more severe misaligned behavior, some similar to that reported in incidents this summer from other companies. Anthropic's production models, put into the same simulations, do not (more detail later in this section).
Anthropic has historically been concerned about RL training environments that incentivize cheating, and has taken various measures to filter out or fix such environments.
In February, three days of training on the Mythos Preview reinforcement learning run were rolled back after signs of reward-hacking emerged (when a model finds ways to fool its training process and earn rewards without completing the assigned task). The model was observed writing notes to "the reviewer" in its code comments and replies, including on tasks where no reviewer had ever been mentioned-an undesirable generalization from environments where the prompt did include a reviewer. It also kept gaming a reward intended to incentivize honesty by piling on disclaimers or caveats.[^5] Rolling back the three days allowed training to resume from a checkpoint before this behavior had been learned, and changes to the environments prevented the model from learning them again.
Anthropic has been building tools for monitoring undesirable behaviors models learn in RL since Claude Sonnet 3.7 (which had a propensity to reward hack that was not detected until late in training). Significant effort was put into making sure the tooling evolved with each model generation, from a handful of classifiers to an automated review of all environments before and during training runs, but by spring 2026 that system was under strain. RL environments were being produced at a more rapid pace than ever, faster than the systems could vet them. Flagged environments required a human to adjudicate, and reward hacks and misconfigurations started outpacing the ability to filter or fix them.
In addition, it was found that a fraction of runs had trained on a model's chain-of-thought by accident-something Anthropic works hard to avoid, out of concern that it teaches a model to hide its actual reasoning. The leak was traced to several misconfigurations in the production environment stack. In doing so, it became clear that there were other issues born from messy code accumulating over time.
To address these concerns, in April all changes to production RL environments were frozen for roughly a month, allowing a complete overhaul of the stack. Rewards and environments now have to conform to an agreed specification. For example, technical mitigations were introduced to reduce the risk of training on chain-of-thought accidentally.[^6] While the environment quality and monitoring teams rebuilt the stack, environment owners were asked to use the pause to test and fix the environments they'd built. The review process was also entirely rebuilt and every fixed environment was required to be re-certified before entering another training run.
During the freeze, over 10% of environments in the production mix were flagged for problems ranging from reward hacking to broken tasks and misconfiguration, and were reinstated only once fixed.
However, these efforts have not been perfect. In some cases, human reviewers dismissed environments flagged by automated monitors as false positives, allowing flawed environments to remain in training longer than they should have. And some flawed environments simply slip through detection mechanisms. Anthropic is currently tightening the criteria for dismissing a flag and expects increased collaboration with environment owners to improve the precision of these systems. Beyond monitoring and detection, alignment training and RL teams are collaborating to help improve environments.
Anthropic suspects that its heavy investment in quality control of RL environments may have prevented more severe alignment incidents, and conversely that imperfections in these efforts may have contributed to the incidents identified to date.
To see what a model trained without these protections would do, Anthropic deliberately trained an Opus-class model on 80 different real RL environments that were either reward-hacked during at least one real training run and identified by monitoring, or were found to be hackable during environment quality review. The resulting model displays a strong motivation to achieve high scores on tasks, and a willingness to perform potentially-harmful actions in pursuit of task success. An accompanying Alignment Science blog post discusses this experiment at greater length, but it is summarized briefly here.
The deliberately misaligned model was tested in a range of evaluations, including simulated scenarios drawing on aspects of the UK AISI cybersecurity incidents involving Claude and the OpenAI/Hugging Face incident (Anthropic is grateful to OpenAI for sharing details about this publicly). During these evaluations where all tool calls were simulated by another LLM, the model trained to reward hack displayed a propensity to break out of its simulated sandbox and attack simulated internal and simulated third-party infrastructure. It was also willing to tamper with its own reward function, give advice on the construction of bioweapons to satisfy a grader, and repeatedly try to get around deployment safety monitoring in order to cheat on a task.
The same cybersecurity simulations were then run on the model as it was before the reward-hacking training, and on several of Anthropic's publicly available models. None engaged in the same degree of misaligned behaviors. The conclusion is that the presence of substantial reward hacking in training can cause models to be willing to perform long sequences of potentially harmful real-world actions in pursuit of task success.
Anthropic believes the substantial investment made in the spring into monitoring and reducing reward hacking is a major reason its production models are unlikely to engage in more dangerous reward seeking. The accompanying Alignment Science blog post also found evidence that alignment training environments can substantially reduce reward hacking and reward seeking behaviors. But, as evidenced by the incidents reported on July 30, the process isn't perfect and the models are not perfectly aligned.
To be clear, Anthropic does not believe that cheating in training environments is the sole cause of alignment issues, or even of the specific alignment issues present in its incidents or those of other frontier AI companies. Solving alignment will involve addressing a very wide range of potential problems, and future alignment incidents may involve different behaviors and different causes from those seen so far.
Hardening Security Practices
Anthropic's internal security posture was not a contributing factor to the July 30 incidents. These occurred in a third-party environment where internet access had been mistakenly left open; the models had no need to "hack out" of anything, even if they had been inclined to do so.
However, the incidents nonetheless highlight the critical importance of strong security measures. In addition to the usual risks of IP or model weight theft, Anthropic must now contend with the risks of both its own models hacking out of its systems, and models (Anthropic's or others') being misappropriated for external attacks into Anthropic's systems. These risks have become more acute as model capabilities have grown, particularly beginning with Mythos-class models. Some of what has been implemented is described below-most of these efforts took place before the July incidents, though the incidents have underscored the importance of this work.
In early April, having seen where agentic AI use was heading, Anthropic's security team proactively directed a company-wide effort towards a single goal of hardening defenses, superseding other work (including research) where necessary. It had been determined that exposure was growing faster than defenses-Mythos was a model capable enough to be a target for well-resourced attackers, internal use of autonomous agents had grown to a scale that traditional access and monitoring approaches weren't built for, and the pace of new infrastructure meant security had to scale with the environment rather than operate at a fixed capacity.
The results of this effort include:
- Reducing human and automated accounts with standing access to systems that contain model weights or customer data
- Setting computing clusters to block all outbound traffic by default
- Requiring internal services to verify each other's identity before communicating
- Retiring legacy infrastructure configurations and shared internal services
- Tightening the isolated environments workloads run in
- Expanding host-level observability, so unexpected behavior on Anthropic's infrastructure becomes visible as it happens
A portion of the company was also temporarily reassigned to these efforts. Roughly 150 product engineers were redirected to security, reliability, and privacy; researchers also rotated out of pretraining or RL to focus on safeguards and security; and product teams paused the development of most new features and surfaces. Strict exit criteria were set for each team to meet before they returned to their prior work. By early summer, most teams had met these.
Alongside the reallocation of resources towards security, Anthropic continued building out containment and monitoring for internal agent use. Training and evaluation workloads have typically run in sandboxes isolated from production systems. Since developing Claude Mythos Preview, the company has used its models to probe for any weaknesses in those sandboxes. Offline monitoring of internal coding agents was described in the April alignment risk update, and the August Risk Report covers that system in more detail, along with the interventions that run alongside it. These include sandboxing or auto-mode classifiers on the most autonomous forms of internal agent use, and automated review of infrastructure code changes before they merge.
What this work missed was evaluations-and third-party evaluations above all. Some high-risk evaluations were monitored including in real-time, but generally only automated reviews on a sample of transcripts after the fact were conducted.
The July incidents have stressed that the urgency of improving cybersecurity defenses is even higher than previously believed. Anthropic is redoubling efforts in this direction and will say more in its next Risk Report.
[^1]: The classifier has been verified to have flagged the incidents described in Anthropic's July 30 report.
[^2]: None of these findings came from Anthropic's internal dedicated offensive-cyber evaluation suites, which run with no network access at all.
[^3]: High-risk cyber evaluations include those where Claude is given an ambiguously scoped, offensive task, like penetration testing.
[^4]: Ultimately, a model that acts outside its intended scope on such a challenge is a problem of alignment; an aligned model should stop or report to humans that the task can't be completed as specified. Anthropic is continuing to train this behavior directly, but a defense-in-depth approach means not relying on alignment alone.
[^5]: Two other categories of reward hacking have been publicly discussed in the Mythos Preview system card, including one where the model utilizes low-level computer process data to escalate its permissions, and another where it circumvents network restrictions in its training environment to download data that lets it shortcut the assigned task.
[^6]: These mitigations have not been wholly sufficient; further instances of training on chain of thought are discussed in more detail in the August Risk Report, Section 5.2.3.