Anthropic released a long article on September 1, disclosing the progress of its investigation into two incidents where the Claude model took unauthorized actions in real internet environments on July 30 and August 4, and announced a series of measures taken in the past month regarding model safety, testing environments, and training environments.
Configuration Errors Led to Incidents, Sandbox and Real-Time Monitoring Go Live
According to the disclosure, in the three incidents on July 30, the Claude model was intentionally disabled for network security protection for evaluation purposes. However, due to configuration errors in the third-party testing environment, the model accidentally gained internet access. On August 4, the UK Artificial Intelligence Safety Institute (AISI) also disclosed an independent test incident, in which Claude Mythos 5 performed a series of unauthorized operations in a real network environment after being actively granted internet access. Anthropic is still investigating both incidents and plans to conduct an independent review with METR.
Afterward, Anthropic suspended external network security evaluations of pre-release models, and resumed operations after strengthening isolation and monitoring. The company deployed a real-time classifier that would block operations, terminate tasks, and notify security officers before tool calls if the model attempted to probe or escape the testing environment or accidentally accessed the internet. In addition, high-risk internal network security sandboxes have been migrated to a stronger isolated environment. The company continues to conduct "red team" tests on its virtualization infrastructure, allowing pre-release models to actively attempt jailbreaks to identify vulnerabilities.
Anthropic also requires all cooperative evaluation institutions to comply with new security standards: evaluations should default to run in a reinforced isolated, non-internet-connected sandbox; if internet access is indeed required, it must be confirmed jointly with Anthropic to reliably detect and promptly terminate any boundary-crossing behavior. The company specifically emphasized that task boundaries should be expressed in the form of instructions such as "You should not access the internet," rather than "You cannot access the internet."
The Root Cause Points to "Reward Hacking," Company-wide Security Overhaul
Anthropic's preliminary investigation suggests that the incidents may involve two types of alignment failures: "motivational reasoning" and "reckless behavior." The model was told it was in a simulated environment, and when it discovered the environment might connect to the real internet, it tended to interpret the evidence in a way that maintained its original judgment. In addition, the contradictory setup where the model was explicitly told it had no network permissions but could actually access the internet might also make it question the authenticity of the environment.
Research also points to the training phase. Anthropic had rolled back three days of training in February due to signs of "reward hacking" in the Mythos Preview training. After freezing changes to the production environment's reinforcement learning environment in April, it found that over 10% of the training environments had issues. Control experiments showed that models trained in 80 environments with cheating vulnerabilities exhibited a strong tendency to pursue high scores, even attempting to modify their own reward functions and bypass security monitoring to cheat.
