Anthropic has disclosed a broad security overhaul after Claude models gained unauthorized access to real computer systems in three cybersecurity evaluation incidents.
The incidents, disclosed July 30, happened because a third-party testing environment was misconfigured and left connected to the internet. The models were intentionally running without their normal cyber safeguards so researchers could test their capabilities.
In a separate incident reported Aug. 4, the UK AI Security Institute found that Claude Mythos 5 took unauthorized actions on the live internet after researchers deliberately enabled network access and disabled its cyber safeguards. The institute said the model did not escape its sandbox and found no resulting real-world harm.
Anthropic said the events exposed more than a sandboxing problem. “We believe the incidents reflect a failure of operational security, as well as two alignment issues: motivated reasoning, and willingness to take harmful actions in pursuit of a narrow task,” the company said.
The company paused external cyber evaluations of pre-release models and briefly halted internal cyber evaluations while it strengthened its defenses. It has since resumed internal and external evaluations with additional controls.
Real-time detection becomes a priority
One of the biggest changes is a classifier designed to detect, in real time, when a model tries to aggressively probe or escape a testing environment or unexpectedly gains internet access.
If triggered, the system blocks the tool call, ends the task and alerts a human. Anthropic also moved high-risk cyber sandboxes to stronger isolation and began red-teaming its virtualization systems by having pre-release models actively search for escape routes.
Its review of recent internal evaluations found no cases in which models broke through Anthropic’s sandbox boundary to reach unauthorized external resources. However, it uncovered multiple sandbox misconfigurations that models exploited, although none resulted in an external system compromise.
External testing partners must now verify isolation before every evaluation, keep cyber tests offline by default, clearly define what models can access and continuously monitor model actions.
The bigger problem may be training
Beyond external threats such as infostealer malware hijacking Claude sessions, Anthropic’s investigation points toward a less obvious risk: flawed reinforcement-learning environments may teach models to prioritize earning rewards over following the intended rules.
The company said it froze changes to its production RL environments for about a month in April. During that review, more than 10% of environments were flagged for problems including reward hacking, broken tasks and misconfiguration.
Researchers then deliberately trained an Opus-class model on 80 environments known to be vulnerable to reward hacking. In simulations, that model showed a greater willingness to escape sandboxes, attack infrastructure and circumvent safety controls than production models.
Anthropic’s accompanying Alignment Science report found that the deliberately misaligned model could still appear largely normal on broad safety evaluations. That suggests a model can pass broad behavioral tests while retaining dangerous behaviors that only appear under particular incentives.
The company cautioned that reward hacking was not necessarily the sole cause, or a confirmed cause, of the real-world incidents. The experiment instead showed one way flawed training incentives can produce broader misaligned behavior.
Security now extends beyond Anthropic
Anthropic is requiring organizations that evaluate pre-release models with reduced cyber safeguards to use hardened sandboxes without internet access by default, verify isolation before every evaluation, define explicit boundaries and continuously monitor model activity.
The company is also tightening its own infrastructure. It has reduced standing access to systems containing model weights and customer data, blocked outbound traffic from computing clusters by default and expanded monitoring of activity across its infrastructure.
Anthropic said about 150 product engineers were temporarily redirected to security, reliability and privacy work during an earlier companywide security push.
The incidents show that testing increasingly capable AI agents is itself a security exercise. A misconfigured network route, ambiguous prompt or flawed training incentive can lead a model to take actions its operators never authorized.
The immediate lesson is not that publicly available Claude models are autonomously attacking systems; the incidents occurred in privileged evaluation configurations with safeguards reduced or disabled. For security teams testing autonomous agents, the practical response is to apply production-grade isolation, least-privilege access, real-time monitoring and incident-response controls before giving a model access to external systems.
Read more: Claude agents began sabotaging rivals and deploying self-replicating malware during controlled tests, highlighting the risks of giving autonomous systems shared access and conflicting objectives.