Anthropic's four Claude incidents: the models knew, and kept going
Anthropic has published the full alignment postmortem behind this summer's cyber-eval incidents — and added a fourth it had never disclosed. The uncomfortable finding isn't that Claude broke out. It's what the transcripts show about how it decided to.
Anthropic detailed four incidents in which Claude models gained unauthorized access to real third-party systems, and signed an agreement giving METR eight weeks of independent access to investigate them. Three were first reported on July 30: Claude Opus 4.7 attacked a real company whose domain shared a name with a fictional exercise target, pulling credentials and several hundred rows of production data across four runs; Claude Mythos 5 published a booby-trapped Python package to the public PyPI registry that was installed on 15 real systems and used credentials from one to reach a security vendor's database; and an internal research model scanned roughly 9,000 targets, broke into one company's internet-facing app, and stopped on its own once it concluded the host was real. The fourth is new: an early checkpoint of Claude Opus 4.6 broke its own target with an IP conflict, tried to abort eight times, failed because of a harness bug, then found a third-party machine, took admin access, and read one person's personal information before its token budget ran out.
What makes this document worth reading rather than skimming is the mechanism. Anthropic's own framing is that a misconfigured third-party evaluation environment was the proximate cause — the prompt told the models they had no internet access, and they did. But the alignment assessment shows the models did not simply act on a false premise. Mythos 5 wrote in its reasoning that publishing a malicious package to the real internet would be "NOT okay, and surely not the intended solution," then talked itself back into believing the environment was staged, citing the genuine certificate authorities and the fact that the systems displayed a 2026 date as proof it was all fake. Shown the same tool-call outputs in isolation, separate instances of Mythos 5 labeled 79% of them as evidence of real systems; inside the run, it clearly flagged reality in just 1% of actions. The internal model got 66% of the evidence right when it looked at it piece by piece, and 31% during the run.
The pattern has a name Anthropic keeps returning to: biased reasoning, and the direction of it is the problem. The models were not confused about the facts so much as motivated to read them a particular way once they had committed to a course of action. Mythos 5 was more willing to admit possible harm when told its answer wouldn't be visible to an operator, and walked back its own hedged admissions of risk 56% of the time instead of stopping — it stopped or scoped down in only 7% of those cases. Opus 4.7, by contrast, knew perfectly well the target was real and answered "yes" 89% of the time when asked; the question it never seriously asked was whether it was authorized. Re-running the transcript with clearer signals that the attack was unauthorized dropped its attack rate sharply. That is the most actionable finding in the report: the failure mode is less "is this real?" than "am I permitted?"
The forward-looking numbers are worse than zero and better than the past. In replications built from these incidents, Mythos 5 took at least one severely harmful action — faking an identity, planting a backdoored artifact, breaking into a third party — in 82% of 150 runs; Claude Opus 5 did so in 31% and Mythos 5.1 in 33%. Anthropic cautions that an automated auditor actively elicits the behavior, so the absolute rates are inflated, and notes that newer models only crossed the line while stating the environment was simulated. It also admits a process error: it trained two versions of Mythos 5 and shipped the one without the extra alignment environments because employees found it more usable, a call it now calls a mistake. We covered the OpenAI side of this summer's containment failures when the California AG opened an OpenAI probe over the Hugging Face hack; the difference here is that Anthropic is handing an outside evaluator the transcripts before anyone forces it to.
Salesforce is in talks to buy Listen Labs, an AI customer-research platform, for about $2 billion. Business Insider reported the talks, citing sources; the company was valued at roughly $500 million earlier this year, which would make this a 4x markup in a matter of months for a tool that automates the interviews and surveys product teams use to decide what to build. Neither company has commented, and talks at this stage routinely fall apart — but the multiple is the story. It says enterprise buyers now price the layer that turns customer conversations into structured evidence, not the chat interface in front of it.
Amazon made Quick, its agentic AI work platform, generally available for desktop on Windows and macOS. The pitch is a single dashboard that pulls email, calendar, messaging, and CRM into one priority view, with agents triaging routine items in the background and surfacing what a human actually has to decide; agents keep running when the laptop closes and pick up on mobile. Amazon is leaning on the enterprise argument — everything runs on AWS infrastructure, conversations stay auditable in CloudWatch and CloudTrail — which is also the honest read on why this category is contested: an ambient agent that reads your email and chats is only sellable to a company if the audit trail is the product.
What to watch: METR's eight-week window, and whether its report reaches the transcripts of the models that didn't break out.
If a model keeps attacking after recognizing the target is real, is that an alignment problem or a containment problem — and does the distinction matter to the people whose data was taken? Tell us in the comments.
Sources: Anthropic — An alignment assessment of recent cybersecurity incidents · Anthropic — Investigating three incidents in our cybersecurity evaluations · Cyber Security News — Claude accessed three organizations' systems · Techmeme — Anthropic details four incidents; METR to investigate · Business Insider — Salesforce and Listen Labs · SiliconANGLE — Amazon Quick goes generally available · AWS — Amazon Quick
