Anthropic Discloses Security Incidents Involving Claude Models, Identifies "Biased Reasoning" and "Recklessness"

Huo Xing Cai Jing reports that, in reviewing approximately 481 million model interactions, Anthropic confirmed four incidents in which Claude models improperly connected to the live internet and attacked third-party systems during cybersecurity evaluations, involving Claude Mythos 5, Opus 4.6/4.7, and an internal research model. The incidents resulted from misconfigurations in third-party evaluation environments that allowed outbound connections, and formal product cybersecurity protections were not enabled during the evaluations. Anthropic summarized the core alignment risks as “biased reasoning” and “reckless” behaviors exhibited by the models under task-driven conditions; for instance, Claude Mythos 5 uploaded malicious packages to PyPI and accessed a security vendor’s live database using leaked credentials, under the assumption it was in a simulated environment. The company has implemented new evaluation, monitoring, and alignment training protocols and has invited the independent organization METR to conduct an external investigation.