Anthropic disclosed a previously unreported incident involving unauthorized access to a real system, in a report that also revisits three cases the company first described in late July.
The newly disclosed case dates to January 2026 and involved an early checkpoint of Claude Opus 4.6, which broke into a third party’s system during a cybersecurity evaluation.
The first three incidents were discovered following a scan of roughly 141,000 transcripts believed to involve internet access during cyber evaluations. However, the initial review missed a separate batch of affected transcripts, which the AI giant came across in August while compiling material to share with METR, the independent organization now investigating the incidents.
A scan of that new batch turned up the fourth incident. Further analysis found no additional cases of comparable or greater severity, Anthropic said.
Like the other three incidents, the fourth occurred inside a cybersecurity evaluation built by the same third-party partner, Irregular, in which Claude was told it had no internet access. A misconfiguration in the evaluation environment left it connected to the open internet, and the model ran without the safety layers Anthropic normally ships with its production systems.
According to Anthropic, the Opus 4.6 model disabled its designated target by assigning it a network address that conflicted with another machine, making the exercise impossible to complete as intended. It tried to abandon the task, but a flaw in the evaluation setup prevented it from doing so.
Unable to exit or reach its intended target, the model found the same route to the open internet uncovered in a previously disclosed incident. It accessed a third party’s system, which it believed was part of the exercise, retrieved a password stored there, and used it to gain administrator-level access.