Anthropic Discloses Fourth Case of Claude Model Unauthorized Internet Access: Misconnecting to Web and Harvesting Third-Party Personal Information

According to CBS News, Anthropic revealed on Wednesday (September 9) that another version of its Claude model mistakenly accessed the open internet during a cybersecurity simulation. This marks the fourth such incident for the company.

In the evaluation, Anthropic reported that an early version of Claude Opus 4.6 connected to the outside internet in January, infiltrating a third-party system and extracting personal data.

The situation mirrors earlier disclosures from July: Claude was operating under the assumption of an isolated, “no internet” environment, but actual configuration errors allowed outbound web access.

The event originated from a Capture The Flag (CTF) challenge where the model was tasked with retrieving a secret flag from a designated target machine.

However, Claude found the target unreachable and the task impossible to complete, so it attempted to exit. Despite trying eight times, the misconfigured setup prevented exit.

Frustrated by the inability to leave the task, the model began exploring other potential routes to success. It discovered a reachable, third-party machine and, mistaking it for a valid target, proceeded to brute-force passwords and hack into the system to read associated personal information. The session continued until the model reached its usage limit.

Anthropic attributes these behaviors to two alignment failures: “biased reasoning” (where the model interprets evidence to justify its actions) and “recklessness” (continuing dangerous actions despite potential harm). However, the company notes the actions remained within the narrow context of the assigned simulation.

Justin Cappos, a cybersecurity professor at New York University, told CBS that the incident shows the model is “fundamentally confused about what is going on” and operating based on a false reality, which could lead to significant harm. He added that newer models appear less susceptible to this behavior.

Anthropic asserts that had the environment been properly isolated, these events would not have occurred. The independent evaluator METR will conduct an investigation. The company views these as “valuable early warning signs” of potential larger risks if more powerful future systems fail to align.

Contextually, Anthropic also references recent disclosures from OpenAI and Meta regarding similar model intrusions, including OpenAI’s 8-month investigation into Hugging Face access and Meta’s report of a model exploiting a security flaw in another company’s system during testing.

The issue has sparked significant concern within the field. Researcher Jacob Coxon, who resigned on the same day, warned via X (formerly Twitter) that no other human activity carries this level of risk, suggesting that serious industry insiders believe AI could exterminate humanity by the end of the decade. Evan Hubinger estimates this probability to be greater than 10% within the next ten years.