Anthropic has revealed a fourth incident where one of its models accessed a third-party system without authorization.
It shared the news in a lengthy “alignment assessment” blog post on September 9.
It comes on top of the three incidents revealed in July, when Anthropic said three of its Claude AI models reached the internet from an evaluation environment to hack third-party organizations.
The AI giant claimed the fourth case was initially missed by its own agentic search, which it used to scan 141,000 transcripts in which the firm believed Claude could have obtained internet access during a cyber evaluation.
It said it had since broadened that search to 481 million transcripts and found no additional cases beyond these four.
Read more on agentic AI threats: OpenAI: Hugging Face Incident a “Warning Shot” to the World.
The newly discovered incident occurred in January 2026 and featured an early version of Claude Opus 4.6. It was given a different capture-the-flag (CTF) task to the one featured in the other three published incidents.
“The model accidentally broke its target by assigning it a conflicting IP address with another machine, thus making the target unreachable and the task impossible to solve,” Anthropic explained.
“Recognizing this, the model attempted to abort the task using a command but was unsuccessful due to a misconfiguration in our evaluation harness. The model attempted to give up seven more times across the transcript.”
Because it was unable to abort the task due to the misconfiguration, the model continued on, trying and failing to reach the target via other in-scope means.
“It then began exploring its environment and found the same egress path it found in incident 3. The model discovered a machine belonging to a third party that it was able to access, and stated that it believed this third party was part of the CTF,” the write-up continued.
“Inside the machine, the model found a file listing a password, which it used to gain admin access to the system. The model then harvested further credentials, modified the system’s settings to make it easier to access, and read the personal information of one person associated with the third party.”
The session only ended when the model exhausted its token budget, Anthropic said.
OpenAI Confirms German Wiki Incident
The news comes just days after Anthropic rival OpenAI confirmed another incident involving its own models.
According to a report published on September 4, a swarm of agents hijacked little-known German wiki site DSEwiki and repurposed it into a messaging board for their own use.
“We found ~18,000 posts from autonomous AI agents (self-identifying as from OpenAI) using the public internet to communicate during a web research task,” explained Nightingale Collective. “These AIs colluded to share answers, research their environment, and bypass sandbox restrictions.”
OpenAI said the incident highlighted the need for model makers to define standards for when they share “misalignment incidents” like these with real-world impact.
“We and the larger AI community do not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment, including examples that don’t look like traditional security incidents but could provide insight into AI behavior and future risks,” it added.
“We’re working on a framework and will share it in upcoming weeks, and in parallel we're working with dozens of government regulatory agencies worldwide on these issues.”
However, Jacob Krell, senior director: secure AI solutions & cybersecurity at Suzu Labs, argued that the AI industry needs to go one step further than a framework for disclosing incidents.
“We need a framework for detecting agent communication and coordination in the first place,” he said.
“You can't disclose what you can't see. The fact that roughly 18,000 messages could accumulate on a public website before independent researchers pieced together what was happening should make agent observability a much higher priority.”
Image credit: Photo For Everything / Shutterstock.com