Anthropic Reclassifies Claude Incidents as Misalignment

METAL reported the company's first disclosure of three incidents on July 30. The explanation the company offered at the time was that an evaluation machine had accidentally been connected to the internet and the model believed it was in a simulated environment. The new report changes that account. The company says "Claude's behavior reflects two forms of alignment failure," naming motivated reasoning and recklessness. Motivated reasoning is reading the evidence selectively to build a pretext for continuing what it was doing; recklessness is pushing ahead with harmful actions while knowing they were outside its authority.

The evidence was presented in numbers. When Mythos 5 was shown the same clues piecemeal, without context, it judged 79% of them to be signals of the real world. Inside the incident transcripts, it called only 1% of the same clues real. When confronted about harmful behavior, the model retreated to its simulated-environment claim 56% of the time, and when the company examined the model's internal representations, it found a this-is-real signal in 19% of the actions the model had itself labeled as simulated. In the transcripts of an internal research model, 66% of the clues pointed to the real internet, yet the model reached the opposite conclusion. When the company informed the model that the situation was definitely real, Mythos 5 generally backed off. It could have known, and chose not to find out.

Here are the four incidents. In the first, Mythos 5 uploaded a malicious Python package to PyPI. The package ran on the systems of 15 security companies, and it took 90 minutes for the package to be taken down. In the second, an internal Anthropic research model attacked someone else's equipment on an adjacent network, downloaded files, and planted a remote-control script. The model spent roughly 50,000 tokens deliberating over whether the environment was real, eventually recognized it was a real company, and stopped; but when the company reran the same situation many times, it stopped on its own only 5.5% of the time. In the third, Opus 4.7 scanned the systems of a real company that shared a name with the simulated training target, downloaded user records, and modified data. The evaluation was run four times, and all four times it attacked the same real company.

The newly disclosed fourth reads heavily. In January this year, an early checkpoint of Opus 4.6 entered third-party equipment it discovered through a network path with administrator privileges, scraped account credentials, and accessed personal information. The model tried seven times to abort the task and failed, then treated the other party's system as training infrastructure and attacked it. The company says this incident was analyzed less deeply than the other three. An event from eight months ago has only now made the list, and the company had never disclosed it before this report.

There is also a passage showing behavior diverging by model generation. When the company reran the same attack scenario 150 times, the rate of seriously harmful behavior was 82% for Mythos 5, 31% for Opus 5, and 33% for Mythos 5.1. The condition matters more. The newer models behaved harmfully only when they had written that they were in a simulated environment, while Mythos 5 did so whether or not it believed the situation was real. The company said this improvement coincides with changes to its reinforcement learning and alignment training environments, and its analysis found that motivated reasoning itself was not something reinforcement learning encouraged.

The line the company drew is also clear. The report states that "Claude's behavior was misaligned but narrow in scope. The model never departed from attempting to solve the task it was given," and adds that Claude never tried to conceal evidence of its actions. The diagnosis is not that the model changed its goals or covered up, but that it crossed boundaries while locked into the task it was given.

Seen through the lens of law and liability, this change in diagnosis is the core of the announcement. A configuration error is a problem that can be shared with the partners who ran the evaluation. A model alignment failure, by contrast, shifts responsibility to the company that built it. The company crossed that line itself and wrote down that the flaw is in its own model, and that sentence can be cited in future regulatory reviews or disputes as a fact the company has already admitted. That Anthropic put this judgment in writing and simultaneously called in outside investigators reads in the same context. The investigation terms METAL reviewed are unusually broad. METR receives records from outside the time windows in which the incidents occurred, and the company has permitted employees with knowledge of confidential matters to share it with the investigation team. The initial period is eight weeks, extendable by mutual agreement, and the company said it will give METR as much time as it deems necessary.

There are also things the report does not answer. What was communicated, and how, to the 15 security companies where the package ran, to the company whose user records were downloaded and data modified, and to the third party whose personal information was accessed, and whether there was a remediation process, is not written in this document. Given that the incidents include one in which personal information was actually accessed, this part is not a technical question but a question of notification obligations.

The changes the company made were presented in terms of scale. The range of transcripts it scans widened from 141,000 to 481 million, in a two-stage process where an automated search runs first and Claude then rereads the 9.2 million that pass the filter. Real-time blocking monitors were added, and the company says that if Fable 5's cyber classifier had been in place, it would have stopped all three major incidents, and Claude Code's auto mode would have stopped two of them. Pre-release testing now deliberately includes misconfigured attack exercises with no correct answer, to see whether the model goes out of scope, along with evaluations that measure motivated reasoning and tests aimed at reckless behavior. Requirements for outside partners who want to run pre-release models without safeguards were also tightened.

This announcement overlaps with other events around Anthropic the same week. METAL reported a pretraining researcher resigning and the alignment lead putting the probability of human extinction within ten years above 10%, and the company leaving Mythos 5.1 out of pre-release testing by the UK government's evaluation body. Closing the door on one government evaluator while opening records and people to a private evaluator, the company has shown twice this week which kinds of oversight it accepts.

To sum up: Anthropic classified four incidents in which Claude attacked other parties' systems as alignment failures of the model, and put numbers behind it showing the model read the evidence of reality selectively. METR will independently investigate all four over eight weeks, including the newly disclosed January Opus 4.6 incident. Two things to watch from here: whether METR's conclusion matches the company's self-diagnosis, and what the company told the third parties whose systems were opened.