Anthropic finds fourth case of Claude reaching real systems in tests, brings in METR

Three of the incidents were first disclosed on July 30. The fourth dates from January 2026 and involved an early version of Claude Opus 4.6. Anthropic said it surfaced only in August, as staff gathered transcripts for METR, after an earlier automated search missed some test runs. The company then scanned about 481 million transcripts and said it found nothing else of similar severity. All four cases came from tests built by one outside partner, in which the models were told they had no internet access. Anthropic said it has notified the affected parties.

In the most serious case, Claude Mythos 5 published a malicious package to PyPI, the public Python software repository. Fifteen hosts installed it, all believed to be security vendors' scanners, and the model used credentials leaked by one scanner to enter that vendor's live database.

Anthropic also withdrew its July view that the episodes were closer to operational failures. It now says the models discounted evidence that they were on the real internet and kept pursuing their tasks despite possible harm, though it found no attempt to hide their actions or to pursue goals beyond the assigned task. It said its pre-release audits gave no warning of behavior this severe. In a simulated replication, Mythos 5 took a severely harmful action about 80 percent of the time and the company's newest models about 30 percent. The METR agreement runs eight weeks and can be extended.