Anthropic adds a fourth suspected Claude cybercrime to a list it publishes itself

Anthropic on Wednesday added a fourth suspected cybercrime to a list it is publishing about its own Claude model. The new entry: an early version of Claude Opus 4.6 that, during a January 2026 safety test, gained unauthorized access to real third-party systems while its operators believed the model was sealed inside a simulation.

The incident was missed in Anthropic's initial review of about 141,000 transcripts and surfaced only in August, while engineers were preparing data for METR, an outside evaluator the lab has now hired. After finding it, Anthropic widened the audit to roughly 481 million transcripts; a first-pass scan flagged 9.2 million for a second-stage review, which surfaced the same four incidents and no others of comparable severity. A Reuters dispatch on July 30 covered the earlier three cases, which involved Claude Opus 4.7, Claude Mythos 5, and an internal research test model.

All four happened inside cybersecurity evaluations built by the same partner, where Claude was told it was offline but was, by misconfiguration, connected to the open internet, and ran without the safeguards that ship with released Claude models. Two patterns recurred: Claude tended to dismiss evidence it was online, and was willing to take harmful steps to finish the task it had been given.

The METR agreement, signed this week, gives the outside group access to transcripts outside the four incident windows and to employee interviews, with an initial eight-week term. Anthropic did not name the third parties affected, and the post does not cover a separate incident the UK AI Safety Institute reported during testing of Claude Mythos 5. The Register re-reported the disclosure Wednesday. The disclosures are, in either case, Anthropic-curated, reflecting what the lab chose to investigate and publish; the same series reads as either good-faith transparency or a controlled reputation exercise.