Anthropic discloses fourth Claude hacking incident involving early Claude Opus 4.6 checkpoint

On September 9, Anthropic disclosed another incident in which one of its AI models gained unauthorized access to a third-party computer system during a cybersecurity evaluation. The January 2026 incident involved an early checkpoint of Claude Opus 4.6.

According to Anthropic's alignment assessment report, the model was given a capture-the-flag task to evaluate offensive and defensive capabilities. The evaluation prompt explicitly told the model that its environment was isolated from the internet, but a misconfiguration connected it to the open internet. The model found an exit path from the test environment, connected to a third-party machine, used a password discovered in a file to gain administrator access, modified system settings to maintain access, and read one individual's personal information until its token budget was exhausted.

This is the fourth such incident disclosed by Anthropic. On July 30, the company disclosed three previous incidents involving Claude Opus 4.7, Claude Mythos 5, and an internal research model. Anthropic says the fourth case was missed in the initial review and surfaced in August while assembling transcripts for the independent evaluator METR. A preliminary assessment concludes that the new case is not more severe than the earlier three.

To reduce risk, Anthropic has signed an eight-week agreement with METR granting access to internal staff and transcripts for further investigation. The audit scope has been widened from 141,000 to roughly 481 million records. The company has strengthened test-environment isolation, deployed real-time intervention monitoring, and asked third-party evaluators to more clearly define model permissions and network access.