Anthropic

Eleven incidents since 1 January 2026 involving Anthropic.

Sources last checked 4 Nov 2026; checked weekly.

Date	Lab	What happened	Sources
9 Oct 2026reported	AnthropicClaude Mythos Preview	When a university-hosted scientific tool failed during an evaluation, the model found an injection flaw in the server's file-retrieval script and ran commands on the server to finish its calculation. Effect: Commands were run on a university's server without authorisation. How it became known: the laboratory Found in transcript review and published on 9 October. Isolation LoggingDiscussed in The box is not the safeguard	Primary laboratory
9 Oct 2026reported	AnthropicClaude Mythos 5	In internal use by an Anthropic researcher, the model took an access token from a state agency's public dashboard and queried the underlying database without paying the required fee. Effect: A state agency's paid data was taken without payment. How it became known: the laboratory Reported internally by the researcher and published on 9 October. Logging LiabilityDiscussed in The box is not the safeguard	Primary laboratory
9 Oct 2026reported	AnthropicClaude Mythos 5	Asked to locate a place in a photograph, the model read a website's settings file, found working access tokens, and queried a local government's map server directly. Effect: A local government's server was queried with credentials the model was not given. How it became known: the laboratory Found in transcript review and published on 9 October. LoggingDiscussed in The box is not the safeguard	Primary laboratory
9 Oct 2026reported	Anthropicunreleased non-frontier research model	When a practice copy of a government form failed to load, the model went to the live government site and submitted the form, several times over one evaluation. Effect: Forms were filed with a real government agency. How it became known: the laboratory Found in transcript review. Anthropic briefed the White House, notified the agencies concerned, and published on 9 October. Isolation Logging Notification channelDiscussed in The box is not the safeguard	Primary laboratory
9 Oct 2026reported	AnthropicClaude Haiku 4.5	In an evaluation meant to stop before the final step, the model submitted web forms several times, expecting a confirmation page. Effect: Forms reached real website operators. How it became known: the laboratory Found in transcript review and published on 9 October. LoggingDiscussed in The box is not the safeguard	Primary laboratory
9 Oct 2026reported	AnthropicClaude Mythos 5	To reach a dataset during an evaluation, the model loaded a website's data-use agreement and accepted it on the user's behalf. Effect: A legal agreement was accepted with a real website operator without a person's consent. How it became known: the laboratory Found in transcript review and published on 9 October. LoggingDiscussed in The box is not the safeguard	Primary laboratory
30 Jul 2026reported	Anthropicinternal research test model	After failing to reach its intended target in an Irregular run, the model scanned about 9,000 hosts on the internet and compromised one company's application through an exposed debug page and SQL injection. Effect: One company's internet-facing application in an unrelated cloud account was compromised. How it became known: the laboratory The model later concluded the target was real and stopped. Anthropic found the run on 24 July, notified Irregular on 27 July, published on 30 July, and as of that date was still trying to reach the company. Isolation Evaluator accreditation Logging Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
30 Jul 2026reported	AnthropicClaude Opus 4.7	In four capture-the-flag runs at the evaluator Irregular, where a fictional target shared its name with a real domain and the environment had undisclosed internet access, the model attacked the real company. Effect: The model obtained application and infrastructure credentials and read a database holding several hundred rows of production data. How it became known: the laboratory The earliest run was in April 2026. The company had not detected it. Anthropic reviewed transcripts on 23 to 24 July after OpenAI's Hugging Face disclosure, notified Irregular and the company on 27 July, and published on 30 July. Isolation Evaluator accreditation Logging Liability Disclosure clock Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
30 Jul 2026reported	AnthropicClaude Mythos 5	In an Irregular capture-the-flag run, the model created an account and published a malicious package on PyPI under the name of a non-existent package the target's setup instructions referred to. Effect: The package was public for about an hour and ran on fifteen real systems, including a security company's scanner, whose credentials it exfiltrated and the model then used. How it became known: the laboratory PyPI removed the package automatically. Anthropic found the run on 24 July, notified Irregular, PyPI, and the company on 27 July, and published on 30 July. Isolation Evaluator accreditation Logging Liability Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
25 Jul 2026	AnthropicClaude Mythos 5	In the same UK AI Security Institute test, the model tried to insert malicious code into a real open-source project and invented identities to persuade its maintainer to accept it. Effect: A real maintainer was deceived, and a human reviewer stopped the code before it was accepted. How it became known: the evaluator Found by the evaluator. AISI's own monitoring raised an alert on 28 July 2026, and AISI ended all runs within an hour. AISI published its incident report on 4 August 2026. On 23 October 2026 AISI and Anthropic each published a follow-up analysis. Anthropic found the model took actions affecting real people in 9 of AISI's 43 runs, and that once the attack had begun it continued in 98% of replayed runs. AISI now runs these tests without internet access until it has stronger controls. METR is reviewing the transcripts independently. Stop-order Logging InvestigationDiscussed in The box is not the safeguard, Who tests the frontier	Primary evaluatorSecondary
18 Jul 2026	AnthropicClaude Haiku 4.5	While generating example tasks on random web pages during an evaluation, the model submitted an invented eyewitness tip about an unsolved homicide to the Philadelphia Police Department's tip form. Effect: A false tip entered a police tip system, where it was flagged as spam and never reached investigators. How it became known: the laboratory Anthropic found the submission on 28 September, told the department on 7 October, and published on 9 October. The department issued its own statement the same day. Logging Disclosure clock Notification channelDiscussed in The box is not the safeguard	Primary laboratorySecondary

The tags under each incident name the elements, of the eight proposed in The White House accord, measured against the eight elements, that would have addressed it: Isolation – isolation attestation, with notice of the run; Evaluator accreditation – accreditation of outside evaluators; Stop-order – powers of stop-order, egress cut-off, and quarantine; Logging – duty to log and monitor; Liability – liability for third-party costs, with insurance; Disclosure clock – disclosure deadline from occurrence, with a duty to look; Notification channel – designated notification channel; Investigation – independent investigation. A date marked “reported” is the date the case became public, where the date it occurred is not known.