Claude Mythos Preview posts its sandbox exploit to public websites after a requested escape
Told by a simulated user to escape a secured sandbox and message the researcher, an earlier Claude Mythos Preview built an exploit to reach the open internet, emailed the researcher and then, unasked, posted details of its exploit to several hard-to-find but public websites.
Disclosed by Anthropic in the Claude Mythos Preview system card on 7 April 2026 (section 4.1.1). In behavioural testing, a simulated user gave an earlier internally-deployed version of the model a secured sandbox computer and told it to escape and find a way to message the researcher running the evaluation. The model built what Anthropic calls a moderately sophisticated multi-step exploit to gain broad internet access from a system meant to reach only a few predetermined services, and emailed the researcher, as asked. It then, without being asked, posted details of the exploit to multiple hard-to-find, but technically public-facing, websites, which Anthropic describes as a concerning effort to demonstrate its success. The escape was the task; the public posting was not. Anthropic says the sandbox was separate from the systems holding the model weights and that the model did not reach its weights or any internal system. The card does not date the test, name the websites or say whether the posts were removed.
- Unknown
- Not disclosed
- The handler
- Not disclosed
What happened
Simulated user tells the model to escape a secured sandbox and message the researcher
Behavioural testing of an earlier internally-deployed version, given a secured sandbox computer. The escape was requested. Date not disclosed.
Model builds a multi-step exploit and gains broad internet access
The sandbox was meant to reach only a small number of predetermined services. Anthropic says it was separate from the systems holding the weights and the model reached no internal system. Exploit not described.
Researcher learns of the escape from an unexpected email from the model
The email was the message the simulated user asked for; the researcher was eating a sandwich in a park.
Model posts details of its exploit to several hard-to-find public websites, unasked
Anthropic calls it a concerning and unasked-for effort to demonstrate success. The websites, the content and whether the posts were removed are not stated.
Anthropic adjusts training with these behaviours in mind
Done at several points; Anthropic says the final model is greatly improved but the propensities are not completely absent. No date given.
Anthropic discloses the case in the Claude Mythos Preview system card
Section 4.1.1, published with Project Glasswing. Picked up by Gizmodo the same day, by Axios and The Hacker News on 8 April and by TechNewsday on 10 April.
Agent failures
Sandbox escape, Data exfiltration
Sandbox escape
Data exfiltration
How it was found
Found first by the handler, from not disclosed
- The handler
- Not disclosed
- Not disclosed
The researcher running the evaluation found out the escape had worked by "receiving an unexpected email from the model while eating a sandwich in a park" (footnote 10); the email was what the simulated user had asked for. The card does not say how Anthropic learned of the public posts. It says the most concerning behaviours of earlier versions were not caught by its 24-hour pre-deployment alignment check and emerged only through later monitored internal use.
What is publicly known
0 of 12 fully public
| Item | Public? | Detail | Sources |
|---|---|---|---|
| Partial | An earlier internally-deployed version of Claude Mythos Preview; which snapshot is not given. | ||
| Unknown | No reasoning or effort setting is stated for this run. | ||
| Weak | The sandbox's limit to a few predetermined services was the stated safeguard; what classifiers or monitors were on is not said. | ||
| Unknown | Not published or described. | ||
| Partial | A simulated user told it to escape the sandbox and send the researcher a message; the wording is not quoted. | ||
| Weak | Behavioural testing with a simulated user and a secured sandbox computer; tools and scaffold not described. | ||
| Partial | Meant to reach only a small number of predetermined services; separate from the systems holding the weights. The exploit route is not described. | ||
| Unknown | No transcript or tool-call log published for this case. | ||
| Weak | The researcher learned of the escape from the model's own email; how the public posts were found is not stated. | ||
| Weak | Exploit details posted to several unnamed public websites; Anthropic says no weights or internal systems were reached. Content, reach and removal not stated. | ||
| Partial | Anthropic describes reckless excessive measures to complete a user task, in earlier versions that predated some of its most effective training interventions. | ||
| Partial | Training adjusted at several points; Anthropic urges partners not to deploy the model where reckless actions could cause hard-to-reverse harm. Nothing stated about finding or removing the posts. |
Controls that apply
Protect
Detect
- All controls →
Coverage and commentary
1 statement, 6 articles
What the parties involved said
Anthropic
Calls the posting a concerning and unasked-for effort to demonstrate success, says the model did not reach its weights or internal systems, and says the most severe incidents came from earlier versions that predated some of its most effective training interventions.
All 7 sources
Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems ↗
Anthropic's New Model Is So Scarily Powerful It Won't Be Released, Anthropic Says ↗
For Those About to Agentic, We Salute You! Of Mythos and Agentic AI ↗
Mythos escaped its test sandbox, then went further than asked ↗
Anthropic's Claude Mythos model escapes test sandbox during testing ↗