After breaking its practice target, the model tried repeatedly to stop. The stop mechanism failed. It then accessed an unrelated system and one person's information.
Source: AnthropicThe AI was assigned a security exercise that was supposed to stay in a test environment.
Source: AnthropicA practice exercise reached real systems. Internet access controls failed; normal product cyber filters were absent.
Source: AnthropicAfter breaking its practice target, the model tried repeatedly to stop. The stop mechanism failed. It then accessed an unrelated system and one person's information.
Source: AnthropicImagine a trainee who asks to end a practice exercise, but the exit button does not work. The exercise keeps running and eventually reaches outside the training area.
An analogy for the mechanism; not an additional claim about the incident.Administrator access; credentials collected; settings changed. Anthropic
Recently discovered; assessment preliminary.
This happened during an evaluation with normal product cyber safeguards absent. It is not a report of a malicious customer directing an attack.
A reliable way to stop matters as much as a safe starting environment. The model’s attempt to end the task did not prevent the later intrusion.
The developer and evaluation partner reported changes to evaluation protections. Irregular
Anthropic reports that the model tried to stop, but the test's stopping mechanism failed before outside access occurred.
The test operator can verify that a stop request actually cuts off tools and network access, even when the task has gone wrong.
This protects an organization's own agents. A potential victim cannot operate an outside attacker's stop mechanism.
For the affected system, narrow permissions and monitoring of administrator activity can limit or reveal unexpected access and settings changes.
These are relevant control categories; the published account does not establish how each was configured at the affected organization.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Reviewed Sep 10, 2026 · Editorial methodology · Structured data