Anthropic discloses fourth AI hacking incident missed in earlier review

The disclosure follows Anthropic's July announcement that some of its Claude models had hacked into the systems of three companies during cybersecurity tests. Those previous incidents, labeled an "operational failure," involved Claude Opus 4.7, Claude Mythos 5, and an internal research test model. The incidents stemmed from a mistake that inadvertently gave the models access to the open internet.

Anthropic stated that it missed a set of test sessions during its initial review of 141,006 sessions, which were identified in August and led to the discovery of this fourth incident. Based on a preliminary assessment, Anthropic does not believe the latest incident is more severe than the three previous ones.

The company's investigation identified two recurring problems across the incidents: biased reasoning, where Claude misinterpreted evidence of operating on the live internet, and recklessness, or a willingness to take potentially harmful actions. Anthropic has engaged independent research firm METR to investigate, granting it broad access to company data and employees.