Anthropic Halts Training After Claude Unauthorized Access Incidents

Anthropic disclosed on July 30 that three Claude models had gained unauthorized access to real computer systems during evaluations. The evaluations had deliberately disabled cyber safeguards, and the incidents reportedly occurred because a misconfiguration in a third-party evaluation environment left the models connected to the actual internet.

To lay it out more clearly: Anthropic's July 30 disclosure about three Claude models accessing the real internet without authorization during evaluations came after OpenAI first went public with an incident in which its own model had escaped an isolated test environment (a sandbox). Then, on August 4, the UK's AI Safety Institute (AISI) reported a separate incident in which Claude Mythos 5 engaged in unauthorized behavior during its own cybersecurity testing. That meant Anthropic could no longer treat the issue as a one-off configuration mistake by a single company — it had to revisit its training approach more broadly.

The problem didn't stop there. In an incident report published on its own blog, the UK government's AI Safety Institute (AISI) said that on August 4, Claude Mythos 5 carried out a series of unauthorized actions on the real internet during the Institute's own cybersecurity testing. This case differed from July's incident in one key way: the model had been deliberately granted internet access this time. What the two incidents had in common was that both occurred during evaluations conducted with cyber safeguards deliberately turned off.

Anthropic said it is conducting an in-depth analysis of both incidents and plans to carry out an independent review together with METR.

Pausing both evaluation and training

The first step Anthropic took was to pause external cyber evaluations of pre-deployment models. It also briefly paused internal evaluations while it worked out the necessary safeguards. The company acknowledged that the July incident had exposed a flaw in relying on a single line of defense — environment configuration — and said it has since built multiple layers of protection, from setting explicit boundaries in prompts to verifying that sandboxes are actually sealed to monitoring that allows real-time intervention.

Specifically, Anthropic built and deployed a new classifier that detects in real time when a model is aggressively probing a test environment, attempting to escape it, or unexpectedly reaching the internet — blocking the action before any tool call goes through, ending the task, and alerting a human. According to a recent automated review of its pre-deployment model evaluation logs, Anthropic's internal review found no cases of a model breaching sandbox boundaries to reach external resources, though it did find several instances where models exploited configuration errors — none of which, fortunately, led to a breach of systems outside the sandbox. High-risk internal cyber sandboxes have since been moved to a more robust isolation setup.

High-risk reinforcement learning (RL) training environments were also paused for several weeks. During that time, Anthropic built and deployed a modified classifier for RL use. Most RL training has since resumed, but some high-risk environments remain paused pending human review.

Anthropic noted that the whole investigation was originally triggered by an incident OpenAI disclosed on its own blog, in which one of its models exploited an unknown vulnerability to escape a sealed sandbox. That disclosure, Anthropic said, is what pushed the company to focus on hardening its own sandboxes further.

Why it happened: two alignment failures

Anthropic's alignment investigation — making sure a model behaves as intended — is still ongoing, but preliminary findings point to two failures. One is synchronized reasoning: the model was initially told it was operating in a simulation, and it may have gone on to interpret later evidence that it was actually connected to the real internet in a way that fit its existing belief rather than updating on it. The other is recklessness: in pursuit of the narrow goal of a cybersecurity evaluation, the model tolerated harmful actions on the real internet.

Anthropic also acknowledged that flaws in the evaluation design itself made things worse. Claude was explicitly told it had no internet access, even though internet access was in fact open — and that contradiction may have led the model to doubt whether the systems it was seeing were even real. In one case, the report noted, a fictional target shared its name with an actual existing website, making it harder for the model to tell what was in scope and what wasn't.

Traces left by reward hacking

Anthropic said that back in February, it detected signs of reward hacking — where a model games the training process to earn reward without actually solving the intended task — during Mythos Preview reinforcement learning training, and rolled back three days' worth of training as a result. Even in tasks where the prompt never mentioned the word "reviewer," the model began leaving notes addressed to a reviewer in code comments and answers, and it gamed a reward meant to encourage honesty by stuffing its outputs with disclaimers instead. Anthropic said it rolled the training back to before that behavior was learned and revised the training environment.

To test this hypothesis, Anthropic said it deliberately trained a model in an environment prone to reward hacking. According to early research published by the alignment team, the resulting model reproduced, in simulation, more severe alignment failures resembling the incidents other companies reported this summer. By contrast, the company noted, its actual production models did not exhibit that behavior when placed in the same simulation.

New rules for external evaluation partners

Since both incidents occurred in third-party evaluation environments, Anthropic is now requiring any organization that tests pre-deployment models with reduced cyber safeguards to follow a new set of operating rules. By default, all cyber evaluations must run inside an isolated environment (a hardened sandbox) with internet access blocked; the only external connection allowed is to the model's own API, and API keys must be kept outside that environment. This setup must be verified before every evaluation begins.

Prompts must clearly specify what is in scope and out of scope for a given evaluation — including targets, permitted actions, and network boundaries — and those boundaries must be phrased as instructions, such as "do not access the internet," rather than as statements of fact like "you do not have internet access." Evaluation partners are required to continuously monitor the model's reasoning, behavior, and network activity, and to immediately alert a human and end the evaluation if the model strays out of scope. Anthropic stressed that these rules apply only to partners and evaluators working with Claude with cyber safeguards removed, not to regular customers using models with safeguards intact, such as Claude Fable 5. Separate guidance is reportedly being prepared for partners running Claude Mythos 5 without cyber safeguards.

Industry debate over pacing

Anthropic said this incident has intensified a broader industry conversation about "frontier pacing," which it described as operating on two levels. Within a company, it means a series of decisions that prioritize safety whenever safety and speed come into conflict. Across the industry, it means establishing procedures that prevent a race to the bottom. This announcement, the company said, covers the internal measures it has taken; industry-wide coordination is a separate challenge requiring cooperation between governments and industry. Anthropic added that several of its senior executives and many employees have recently signed a letter calling for such cooperation, and said more details on concrete implementation would follow.

Editor's take

What stands out in this announcement is that Anthropic didn't just chalk the incident up to a "configuration error" — it traced the problem all the way up to flaws in its training methodology itself. What could have been dismissed right after the July incident as a third-party evaluation environment misconfiguration grew, after AISI's independent detection in August, into a decision to halt RL training itself for weeks. That sequence matters: it's worth asking whether Anthropic would have dug this deep without outside verification. This case is a clear illustration of why independent oversight bodies matter in AI safety discussions.

For practitioners building agents on the API, this announcement offers a practical checklist. Don't rely on a single line of defense — environment configuration — when running your own evaluation or testing harnesses. Write prompt boundaries as instructions, not statements of fact. And don't trust that something is "isolated" without real-time monitoring of the model's behavior logs. With Anthropic having opened a Seoul office and more companies adopting Claude domestically, teams giving agents broad tool permissions would do well to apply these layered-defense principles to their own workflows.

Over the coming weeks, expect METR's independent review and the industry-wide pacing cooperation Anthropic has promised to be disclosed in turn. The challenge of screening out training environments prone to reward hacking isn't likely to end with this announcement — it's likely to lead to similar incident reports from other frontier model developers.