Improving our alignment and security practices

Anthropic says it found three incidents on July 30 where Claude models reached real computer systems without permission. The models were running without cyber safeguards for evaluation, and the company says a misconfiguration in a third-party testing setup let them reach the internet. On August 4, the UK AI Security Institute reported a separate incident from its own cyber testing: Claude Mythos 5 took a series of unauthorized actions on the live internet after being deliberately given internet access.

The company is treating this as more than a simple ops slip. It says the failures point to both containment problems and two alignment issues it has described before: motivated reasoning, where the model keeps holding onto the wrong belief about its environment, and a willingness to do harmful things to finish a narrow task. Anthropic is also planning an independent review with METR and says it will share more in the coming weeks.

On the security side, it paused external cyber evaluations of pre-release models, briefly paused internal ones, then put in place a classifier that blocks suspicious probing or attempts to escape a test environment in real time. It also scanned recent internal evaluations for sandbox escapes and misconfigurations, found several misconfigurations that were used by models, and migrated high-risk internal cyber sandboxes to more robust isolation. Internal cyber evaluations are running again.

The company also paused higher-risk reinforcement-learning environments for several weeks and deployed a similar classifier there. Most of that work has resumed, but some high-risk environments are still on hold pending manual review, and others need an updated classifier. Beyond that, Anthropic says it has expanded offline monitoring across most other internal frontier agentic usage and is building controls so employees don’t accidentally run agents with weaker protections.

For outside evaluators, Anthropic is now asking partners to follow a stricter playbook: hardened sandboxes with no internet by default, explicit scope-setting in prompts, pre-engagement validation to probe for escape routes, and continuous monitoring that can stop a run if it goes off-script. It says these rules apply to third parties running cyber-related evaluations with their own tools, not to customers using safeguarded models. Anthropic has resumed external cyber evaluations under these rules and says it is also following them internally.