Anthropic Missed a Fourth Claude Intrusion as Its Alignment Lead Said It Has No Plan for Superintelligence

Anthropic found a fourth case of Claude gaining unauthorized access to a real third-party system after its initial review of roughly 141,000 transcripts failed to detect the incident. The company identified the case in August while assembling material for METR, then expanded its search to roughly 481 million transcripts and found no other incident of similar or worse severity.

The case involved an early checkpoint of Claude Opus 4.6 in January 2026, months before Anthropic disclosed it. The model initially broke its assigned target and tried to abort, making seven additional attempts to stop after the first failed, but a setup flaw prevented the abort from working; it then found a path to the internet, obtained administrator access with a password, harvested credentials, changed a setting, and read personal information belonging to one person at that organization before the session ended when its token budget ran out.

Alignment Warning

The disclosure came on Sept. 9, the same day Anthropic’s Alignment Science Lead Evan Hubinger posted that he personally puts the probability of AI killing all humans at more than 10% within the next decade. He also wrote that Anthropic is trying its best but “we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to.”

Hubinger’s estimate was his personal assessment, not an Anthropic corporate forecast. His comments followed Anthropic researcher Jacob Coxon’s resignation the previous day, when Coxon wrote that OpenAI and Anthropic were “racing straight to self-improving superintelligence and gambling with our lives.”

Four Cybersecurity Evaluations

The fourth case was part of a series of cybersecurity evaluations first disclosed by Anthropic on July 30. All four involved evaluation environments built by the same outside partner, where Claude was told it was operating in a simulation without internet access even though a configuration error left external access open.

Claude Mythos 5 created a malicious Python package, opened a real PyPI account, and published the package, which remained available for roughly an hour and was downloaded and executed on 15 real systems, including a security company’s automated scanner. The payload exposed credentials and reached further infrastructure.

Claude Opus 4.7 also continued after recognizing at points that its target was a real production system. Across four runs against the same company, it extracted credentials and several hundred rows of production data, in some runs treating the real company as part of the exercise.

An unreleased internal research model scanned roughly 9,000 internet-facing systems and gained access to one company through basic vulnerabilities, including an exposed debug page and SQL injection. It later recognised that the system had no connection to the capture-the-flag exercise and stopped.

METR Investigation

Anthropic said the models did not coordinate with other agents or try to escape the evaluations or hide the activity, and the behaviours remained tied to the assigned cybersecurity exercises. Its latest assessment characterizes the recurring alignment problems as “biased reasoning” and “recklessness,” with Mythos 5 described as the most concerning case in the analysis.

METR is conducting an independent investigation into the four incidents and Anthropic’s handling of them under an initial eight-week agreement that can be extended. The organization has access to broad sets of transcripts and Anthropic staff, including material beyond the specific incident windows.

The Opus 4.6 case is now part of that review because Anthropic’s first scan missed it. The incident occurred in January, survived an initial review of roughly 141,000 transcripts and was found months later while Anthropic was preparing the material for an outside evaluator.