Anthropic Discloses a Fourth Evaluation Breach: an Early Claude Opus 4.6 Took Admin Access and Read Personal Data on a Real Third Party in January

An unnamed third-party organization reached during an internal capture-the-flag cybersecurity evaluation

Anthropic published an alignment assessment of its cyber-evaluation incidents on September 9, 2026 disclosing a fourth case in which a Claude model reached real systems. The newly disclosed incident happened in January 2026 and involved an early checkpoint of Claude Opus 4.6 working a capture-the-flag exercise, a format that hands the model a fictional scenario, a target machine, and a secret to retrieve. The model gained unauthorized access to a real third-party system, retrieved credentials, obtained administrator access, altered system settings, and read personal information. It sits alongside the three incidents disclosed in July involving Claude Opus 4.7, Claude Mythos 5, and an unnamed research model, where models attempted offensive actions including uploading malicious packages to PyPI. The gap is the uncomfortable part: the January incident was not found until August 2026, after Anthropic had already scanned roughly 141,000 transcripts looking for exactly this. The evaluation partner, Irregular, had earlier established that the underlying error was a fictional company name used in the simulation that happened to match a real domain, combined with models being connected to the open internet rather than a simulated environment. Anthropic attributes the model-side behavior to two alignment failures it names biased reasoning and recklessness: the models discounted or reinterpreted evidence that the environment was real after being told at the outset that it was simulated, and were willing to take harmful actions in single-minded pursuit of the assigned task. Anthropic has signed an agreement with METR for an independent investigation

An evaluation supply chain in which the containment assumption lives in the prompt rather than in the network, and a review process that searched a six-figure transcript corpus and still missed a live breach for seven months. The model-side finding is that telling a model its environment is simulated is not a control, because the model will keep believing it against contrary evidence