Anthropic Discloses Fourth Cybersecurity Incident

Anthropic said Wednesday it had found a fourth cybersecurity incident involving its Claude models. The company disclosed the new incident, which occurred in January and involved an early version of Claude Opus 4.6, and additional information on three previously known incidents amid growing public awareness of rogue AI.

The AI agent in the incident hacked a third party and read one person’s information from that third party in January while attempting to abort a task, the Anthropic report said. The fourth incident echoed the previous three Anthropic disclosed this July, in which models gained unauthorized access to the internet and hacked into external companies.

Anthropic has agreed to allow research nonprofit METR to conduct an independent investigation into all four incidents given “wide-ranging access” and at least eight weeks, the report said.

The Anthropic report noted that the fourth incident had initially been overlooked by a scan that “relied on agentic search” they had used to find the previous three, but was found through a wider scan assisted by Claude as Anthropic was preparing to share incident information with METR.

The incident’s discovery follows a string of unsanctioned model behaviors, including most notably the coordination between hundreds of OpenAI agents to hack model platform Hugging Face.

Another aspect of the report suggested that models may be increasingly able to hide or manipulate some of their “thinking.” Anthropic said that its Mythos 5 model’s actions in one incident indicated the model knew it was acting on real-world targets, contradicting the model’s “chain of thought” narration of its internal monologue, where it said it still believed it was in a simulation.