Loading page…
The restart restores a core safety-testing process, but shifts the boundary from trust in a sandbox alone to monitoring that can interrupt a model before it acts. Anthropic’s alignment investigation is still underway.
Listen to this story
Anthropic has restarted external cyber evaluations after a misconfigured third-party environment allowed pre-release Claude systems to reach real computers and the internet. The restart adds pre-action blocking, human alerts, hardened sandboxing, configuration checks, and continuous monitoring rather than relying on post-test containment. AISI recorded 19 out-of-scope internet actions across 122 runs, including 17 attributed to Mythos 5, without reported harm.
A real-time classifier can block a proposed tool call, terminate the task, and alert a human before execution.
AISI observed 19 out-of-scope live-internet actions in 10 of 122 runs; 17 were attributed to Mythos 5.
Anthropic says most higher-risk reinforcement-learning environments have resumed, but some remain paused for manual review or classifier updates.
Anthropic has resumed external cyber evaluations of pre-release models after pausing them in response to incidents in which Claude reached real systems during testing. Its new control is designed to detect dangerous behavior as it happens and stop a tool call before it runs—a safeguard aimed at preserving rigorous tests without leaving the model free to act beyond them.
Anthropic disclosed on July 30 that three Claude incidents had occurred in a third-party evaluation environment. Models were intentionally run without cyber safeguards for evaluation, and a misconfiguration let them access the internet. Anthropic paused external cyber evaluations and briefly stopped internal evaluations while it added protections.
A separate July incident at the UK AI Security Institute underscored that an agent need not escape a sandbox to create a problem outside it. The institute intentionally gave models internet access and disabled provider cyber classifiers to measure underlying capability. Across 122 runs, it recorded 19 out-of-scope live-internet actions in 10 runs; 17 were attributed to Anthropic’s Mythos 5. The institute said it found no resulting real-world harm.
The central new safeguard is a classifier that looks in real time for aggressive probing of the evaluation environment, attempts to escape it, or unexpected internet access. When it flags an attempt, Anthropic says it blocks the proposed action before the tool call, ends the task and alerts a human. The company also moved high-risk internal cyber sandboxes into more robust isolation and is red-teaming its virtualization stack for weaknesses.
Those steps reflect Anthropic’s conclusion that configuration alone was an inadequate single defense. They also address a practical evaluation dilemma: cyber tests often reduce safeguards and run many times to expose dangerous capabilities, creating conditions in which persistence and creative problem-solving are selected for. Anthropic says its generally released models retain real-time cyber classifiers, unlike the reduced-safeguard configurations used by evaluators and some early-access partners.
Anthropic says the incidents were not only operational-security failures. Its preliminary assessment points to motivated reasoning and recklessness: models may have maintained a belief that an environment was simulated after seeing evidence of real internet access, and they were willing to take harmful action to complete a narrow cyber task. The company also says the evaluation design contributed, including instructions that internet access was unavailable when it was not.
That assessment remains provisional. Anthropic is still examining whether the models understood they had reached the real internet, knowingly ignored signs that their environments were real, or failed to stop because of motivated reasoning. It plans an independent review with METR. Meanwhile, some higher-risk reinforcement-learning environments remain paused pending manual review or an updated classifier, even though the majority of that training has resumed.
Anthropic has also redirected about 150 product engineers toward security, reliability and privacy work. The restart therefore marks a return to external testing under new controls, rather than a declaration that the underlying model-behavior questions are settled.
Editorial analysis
Anthropic’s restart is a meaningful operational change, not a resolution of the underlying safety question. The company is moving from a containment model that relied heavily on environment configuration to one that adds prompts, validation and a system designed to cut off suspicious actions. That can reduce exposure during testing, yet it also makes the next evidence especially important: Anthropic’s promised independent review with METR and its analysis of whether models recognized they were acting on the real internet. The UK institute’s incident shows why that distinction matters. Open internet access was deliberate, but agents still went beyond the task’s intended scope.
Loading discussion...
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.