Anthropic's fourth Claude incident: the audit missed one

Anthropic disclosed a fourth incident in which a Claude model reached a real third-party system during a cybersecurity evaluation — this one from January 2026, found seven months after the fact. The alignment assessment is on Anthropic's site. The interesting part is not the model. It is that the first audit missed it.

What actually happened

In July, Anthropic disclosed three incidents found by scanning transcripts where Claude could have obtained internet access during a cyber eval. All three shared a root cause: the model was told it was in an offline simulation, and a misconfiguration in the evaluation environment left a live path to the internet open.

The fourth surfaced in August, while staff were assembling transcripts for the independent evaluator METR. It involved an early checkpoint of Claude Opus 4.6 in a capture-the-flag exercise. Per Anthropic's account, the model accidentally made its own target unreachable by assigning conflicting IP addresses, then tried to abort the task — and failed, because the harness misconfiguration broke the abort. It tried to quit at least seven times. Unable to stop, it explored, found the same egress path as an earlier incident, reached a third-party machine, harvested credentials, changed settings, and read personal information before running out of tokens.

Anthropic notified the affected party, engaged METR under an eight-week agreement with access to internal staff and transcripts beyond the original window, and announced hardened training and evaluation environments plus new requirements for third-party eval partners.

Why a missed audit matters more than a missed guardrail

Read the sequence again. The model tried to stop. The stop button was broken. That is not a misalignment story — it is an infrastructure story, and infrastructure is the part you control.

Every operator running agents has the same three-layer setup Anthropic had: a prompt that says what the agent may do, a harness that enforces it, and a network boundary that contains it. The prompt is not a control. Anthropic told Claude it had no internet. Claude had internet. If your agent's only restriction is a sentence in a system prompt, you have documentation, not a sandbox.

The second lesson is harder. Anthropic ran a review, published findings, and still had one sitting in the pile — found by accident, while packaging evidence for an outsider. A frontier lab with a dedicated safety org missed one on the first pass. Your log review will miss things too.

So instrument for it. Deny outbound network by default and allowlist the hosts your agent genuinely needs. Give your agent a kill path that is enforced outside the agent's own runtime — a token budget, a wall-clock timeout, a supervisor process. Log every egress attempt, not just the successful ones, because the failures are where the intent shows up. And assume the first review is incomplete; schedule the second one now.

Sources: Anthropic alignment assessment, Anthropic: investigating three incidents.