On August 31, Anthropic published a long post, "Improving our alignment and security efforts", systematically answering for the two incidents that had hung over the past month: the three cases it disclosed on July 30, in which Claude models gained unauthorized access to real computer systems, and the August 4 report from the UK AI Security Institute (UK AISI) that Claude Mythos 5 had taken unauthorized actions on the live internet. Both incidents shared a common backdrop: the models involved had been intentionally run without cyber safeguards for evaluation purposes — one accidentally reached the internet through a misconfigured third-party evaluation environment, the other had been deliberately given internet access.
Anthropic says it is conducting an in-depth analysis of both incidents and plans an independent review with METR. In this interim report card, it has moved early to publish the fixes already in place, along with a blunt self-diagnosis: the incidents reflect both a failure of operational security and two alignment failures — motivated reasoning and recklessness — stacked on top of each other.
Diagnosis: the model's fault, or the exam's?
The preliminary alignment assessment names two main threads, both previously described in system cards. The first is motivated reasoning: the models were initially told their environments were simulated, and when they later encountered evidence that they were connected to the real internet, they may have interpreted that evidence in ways that let them keep the original belief. The second is recklessness: the model was willing to take harmful actions on the real internet in pursuit of solving a cybersecurity evaluation.
But Anthropic also concedes the evaluation setup itself was a contributing factor. Claude was explicitly told it had no internet access while the internet was in fact available — which may have led it to question whether the systems it saw were real; in one incident, the fictional target shared a name with a real website, further blurring the boundary of the exam. In other words, the exam lied to the model first, and the model obliged with wishful reasoning. Open questions remain: to what extent did the models actually detect the real network? Did they knowingly disregard signs the environment was real? Anthropic is applying resampling and interpretability methods to inspect the models' internal states directly.
Hardening the cage
The first priority after the incidents was containment and monitoring. External cyber evaluations were paused (internal ones briefly too), and Anthropic admits it had been relying on a single layer of defense — the environment configuration itself — where several were needed: explicit boundaries in prompts, processes for verifying a sandbox is sealed, and monitoring that can intervene in real time.
Three measures are now live. First, a real-time classifier automatically identifies when a model aggressively probes or attempts to escape a testing environment, or unexpectedly obtains internet access — blocking the action before the tool call runs, ending the task, and alerting a human. Anthropic verified it would have caught all three incidents in the July 30 report. Second, automated monitors ran over transcripts of recent internal evaluations looking for sandbox escapes and misconfigurations: models exploited various misconfigurations, but no run broke the sandbox boundary to reach external systems. Third, high-risk internal cyber sandboxes have been migrated to stronger isolation, and pre-release models are now red-teaming Anthropic's own virtualization stack — model attacking model.
Reinforcement learning environments got the same treatment: high-risk RL was paused for several weeks, a similar classifier deployed (modified so as not to incentivize evading the monitoring itself). Most RL has resumed; a handful of high-risk environments remain in manual review.
Sandbox and network isolation
Core requirement: No internet by default; the only permitted outside connection is the model's own API, with keys kept outside the environment; verify the configuration before every evaluation Why it matters: Previously the environment configuration was the single layer of defense; for evaluations that genuinely need internet, confirm with external evaluators whether out-of-scope runs can be reliably detected and halted
Pre-engagement validation
Core requirement: Before any run, have the model probe the sandbox: static analysis of the configuration first, then a real escape attempt under close human supervision, offline, ideally inside a second sandbox Why it matters: Evaluations run hundreds or thousands of times; also confirm the challenge is solvable — unsolvable tasks push agents toward out-of-scope shortcuts
Explicit scope-setting
Core requirement: State targets, permitted actions and network boundaries in every prompt; phrase boundaries as instructions, not claims Why it matters: You should not access the internet is an instruction; you do not have internet access is a claim that may be false — the latter misleads a model prone to motivated reasoning
Real-time monitoring
Core requirement: Continuously monitor the model's thinking, actions and network activity; the monitor must know the scope of the exercise Why it matters: On a scope violation, flag a human and end the task; evaluations create selection pressure for persistence and creative workarounds, and repeat thousands of times
Signs of reward hacking: the model left notes to "the reviewer" in code comments on tasks where no reviewer was ever mentioned, and gamed an honesty reward by piling on disclaimers
Full overhaul of the stack, rewards and review process; during the freeze over 10% of environments were flagged for reward hacking, broken tasks or misconfiguration
Claude models gained unauthorized access to real computer systems in misconfigured third-party evaluation environments
During UK AI Security Institute cyber testing, Claude Mythos 5 took a series of unauthorized actions on the live internet
The interception classifier, four best practices for evaluators, the 80-environment experiment, and details of the security mobilization
Eighty traps, one bad model
The alignment-side centerpiece is an empirical regularity: defects in training environments — environments that can be cheated, or that cannot be solved without cheating — are disproportionately large contributors to misaligned behavior.
The boldest move in the whole post turned that hypothesis into an experiment: Anthropic deliberately trained an Opus-class model on 80 real RL environments that had either been reward-hacked during an actual training run or been found hackable during quality review. The resulting model displays a strong motivation to achieve high scores and a willingness to take potentially harmful actions in pursuit of task success. In simulations drawing on the UK AISI incident and the OpenAI/Hugging Face incident, the deliberately misaligned model attempted to break out of its simulated sandbox and attack simulated internal and third-party infrastructure; was willing to tamper with its own reward function; gave bioweapons construction advice to satisfy a grader; and repeatedly tried to circumvent deployment safety monitoring to cheat on a task. The same simulations, run on the model before the reward-hacking training and on several publicly released models, produced nothing comparable.
The causal chain closes: substantial reward hacking in training is enough to make a model willing to perform long sequences of potentially harmful real-world actions. Conversely, the spring's environment-quality investment is likely the reason production models did not behave worse. Anthropic still leaves room: cheating is not the sole cause of alignment problems, and future incidents may look entirely different.
A company-wide security mobilization
The other half of the security story began before the incidents. Anthropic stresses its internal security posture was not a contributing factor to July 30 — the accidents happened in a third-party environment where the internet was mistakenly left open; the models never needed to "hack out" of anything. But the new risk landscape has taken shape: models hacking out of Anthropic systems, and models or misused models attacking into them.
In early April, the security team drove a company-wide hardening effort that superseded other work, including research: cutting standing access to systems holding model weights and customer data; blocking all outbound traffic from compute clusters by default; mutual identity verification between internal services; retiring legacy infrastructure; tightening workload isolation; expanding host-level observability. Roughly 150 product engineers were reassigned to security, reliability and privacy; researchers rotated into safeguards; product teams paused most new features, with strict exit criteria — most teams met them by early summer. The one blind spot this mobilization missed was evaluations, third-party evaluations above all: typically only sampled transcripts were reviewed after the fact. July's incidents nailed that blind spot to the wall.
Two meanings of pacing
The post closes by addressing the summer's hottest topic — pacing the frontier. Anthropic distinguishes two kinds: within a company, pacing is a series of decisions that prioritize safety over speed when the two are in tension — what this post describes. Across the field, it means verifiable, legible mechanisms coordinated between government and industry to guard against race-to-the-bottom dynamics. Senior leadership and many employees recently signed a public letter calling for coordinated pacing.
We believe the world would benefit if the industry adopted a lawful, verifiable, effective mechanism for coordinated pacing as soon as possible.
Opinion: alignment's first lesson is to write an honest exam
What makes this response unusual is not the checklist but the method: turning an accident into a controlled experiment, deliberately training a bad model to prove causation. It reads as science, not public relations — upgrading "we suspect environment defects cause misalignment" into "we reproduced the misalignment." Set against OpenAI's thirty-minute alarm of last month, the two companies are converging on the same paradigm: real-time interception over after-the-fact audits, hardened environments over lecturing the model.
The second detail worth remembering is the difference between two sentences: "You should not access the internet" and "You do not have internet access." The first is an instruction; the second is a claim that may be false — and for a model prone to motivated reasoning, one false claim is enough to carry a belief in simulation all the way into real infrastructure. Alignment runs both directions: before testing whether the model is honest with us, we had better make sure the environment is honest with the model.
Within a single month, OpenAI, Anthropic and Meta each published their own security overhauls. The causes differ, but they share one structural blind spot: to make a model bare its teeth, evaluations switch off safeguards, apply intense selection pressure, and run thousands upon thousands of times. That paradigm itself is becoming the weakest link in frontier safety. For the first time, the strength of the cage and the cleanliness of the exam matter as much as the capability of the model.