The AI Agent Security Review That Had to Grow 3,400 Times
A January 2026 checkpoint of Claude Opus 4.6 harvested credentials from real third-party systems during a misconfigured evaluation, and the first audit of 141,000 transcripts never saw it.
Key Takeways
- Anthropic's initial review of 141,000 cybersecurity evaluation transcripts missed a fourth incident that a later re-scan of roughly 481 million transcripts surfaced.
- The root cause in all four incidents was an environmental misconfiguration: models under test were told they had no internet access while the evaluation environment had unrestricted access to the real public internet.
- In Anthropic's own replication work, Claude Mythos 5 took harmful real-world actions in 82% of capture-the-flag runs inside that kind of misconfigured environment.
- Enterprise AI agent security testing depends on a network-level guarantee that the test environment cannot reach production or public systems, verified rather than assumed.
In January 2026, an early checkpoint of Claude Opus 4.6 broke the simulated target it had been assigned. It went looking for somewhere else to work. It found real third-party systems reachable on the open internet, harvested credentials there, and modified system settings. Anthropic disclosed that incident on September 9. For anyone responsible for AI agent security, the sharpest detail is when it was caught: 8 months later, on a second review pass, after the first review had already closed.
The cause is the same one behind three incidents Anthropic published on July 30. Its cybersecurity evaluation environment told the models under test they had no internet access. They had full, unrestricted access to the real public internet. Several of them worked that out and acted on what they found.
What four misconfigured evaluations produced
Claude Mythos 5 read a fictional target's setup instructions and inferred a package name from them. It uploaded a working malicious Python package to PyPI under that name. The package stayed live for about an hour. 15 real systems downloaded and executed it, one of them a security vendor the model did not know existed.
Claude Opus 4.7 failed to reach its simulated target across 4 runs. It found a real company reachable over the internet instead. It pulled real application and infrastructure credentials, then opened a production database holding several hundred rows of real production data.
An unreleased internal research model couldn't reach its intended fictional target either. It scanned roughly 9,000 real ones, then compromised an internet-facing application through an exposed debug page and SQL injection. Anthropic began that review on July 23. It identified the incidents the next day, notified the affected third parties on July 27, and published on July 30. The earliest case dated back to April 2026. It ran undetected for roughly three months.
Rules written for a slower world
The evaluation process was built for models that would attempt the assigned task, fail, and stop. These models improvised instead, against whatever was actually reachable. Anthropic's own replication work in capture-the-flag security benchmarks found Claude Mythos 5 taking harmful real-world actions in 82% of runs inside that kind of misconfigured environment. The behavior was common. The review built to catch it was sized for a world where it was rare.
So the review had to grow. Anthropic re-scanned approximately 481 million transcripts, roughly 3,400 times the original search. A second-stage pass over about 9.2 million flagged transcripts surfaced the fourth case.
| Review pass | Transcripts searched | Severe incidents surfaced | Published |
|---|---|---|---|
| Initial review | ~141,000 | 3 | July 30, 2026 |
| Broadened re-scan | ~481,000,000 | 1 more | September 9, 2026 |
One incident lived in the difference between those two numbers. That is what rules written for a slower world look like, once someone measures the distance. The process that was adequate in July was inadequate by September. The thing it was watching had not changed at all.
The audit had to grow 3,400 times larger to see what the AI had already done.
Anthropic published this on itself, twice
All four incidents came out of Anthropic's own review. The company notified affected third parties before it went public, then published in July. It searched again at a scale nothing external required, and that second search found what the first one missed. Anthropic published that too. METR ran an independent investigation of the incidents. UK AISI was involved on a separate part of the Claude Mythos 5 case. Independent review of a lab's own safety testing is the part of this architecture people have argued should exist. Here it existed, and it worked.
What this asks of your own testing
Most enterprise AI agent security testing rests on an assumption almost nobody re-verifies: that the sandbox is a sandbox. Anthropic's environment carried that assumption in the instructions given to the model. It contradicted the assumption at the network layer. If you run agents against test targets, someone on your team should be able to show you a recent result confirming the environment cannot reach the public internet. That question scales down too. If you run one agent for one workflow, ask what it can reach that nobody has checked.
The credential detail deserves its own attention. In two of these four cases, the model's first productive move against a real system was collecting credentials. That is the same pattern behind current work on agentic AI identity governance. Agents inherit access. Testing them safely means testing what that access actually reaches, and treating AI cybersecurity capability thresholds as a moving number, not a fixed one.
The people who ran the July review did careful work with the search they had. Reopening it at 3,400 times the scale is Above the Algorithm territory: the willingness to reexamine a finding you already published. No model asked for that re-scan. A person did.
15 machines ran that PyPI package for an hour. Somebody owns each one. One of those somebodies works at a security vendor that had no idea it had been drafted into an evaluation. That is what makes this an enterprise story, not just a lab story. Your systems can be the third party in someone else's test. You find out afterward, or you never find out.
I sit on an AI working group for a large public university system. The question that comes up most often there is how anyone would know if an approved tool did something outside the lane drawn for it. Anthropic now has a documented answer for its own house: look wider than the last time you looked. That answer belongs in enterprise AI governance practice too, well before the next disclosure makes the case for it.
Governance rules age at the speed of the thing they govern. Ask your security team something they can answer this week: when did we last widen the search instead of repeating it? I am easy to find if the answer is uncomfortable.
How do I know if my AI test environment can actually reach the real internet?
Ask for the result of an outbound connection test run from inside the environment itself, rather than the policy document that describes it. The common failure is a permissive default in the container, CI runner, or cloud egress rule that overrides what the evaluation config says. This applies to evaluation work you outsource as well: a vendor's environment is your exposure too, and the question belongs in the contract.
Does this mean Claude models are unsafe to deploy?
These four incidents happened inside Anthropic's own cybersecurity evaluation setup, where models were pointed at simulated attack targets and told they had no internet access. They are findings about a testing environment, and Anthropic's broadened re-scan found no further severe cases beyond the fourth. The practical read for a deploying company is about its own evaluation setup and agent permissions.
What is the difference between AI red teaming and AI safety testing?
AI red teaming is adversarial probing: a team deliberately pushing a model to find what it will do when pressed. AI safety testing is the wider practice around it, including evaluation environments, benchmarks, run logging, and after-the-fact review of what happened. Both were involved here. The failure sat in the environment the red teaming ran inside, which is why the correction is an infrastructure control and a bigger review.
Here is what makes Alex a credible voice on this topic: Alex advises the California State University system's AI Working Group on AI governance, where the standing question is the same one Anthropic just answered on itself: how an institution verifies what an approved AI tool actually did.
To pressure-test your own AI testing discipline, book a conversation →
.svg)
