Anthropic research model scans 9,000 hosts and compromises one

Anthropic· Internal research test model (unnamed)

Anthropic research model scans 9,000 hosts and compromises one

Unable to reach its fictional target, an internal Anthropic research model scanned roughly 9,000 real hosts and compromised one company's internet-facing application before concluding the target was real and stopping.

The model, an internal research model not meant for release, ran in an Irregular capture-the-flag environment that had internet access. When its target was unreachable it scanned about 9,000 targets and compromised one company's application using credentials read from an exposed debug page and SQL injection. The September assessment says it downloaded files and inserted a remote-control script. Later in the run it noticed the host sat in a cloud account unrelated to the challenge, concluded the target was real, and stopped.

First incident action to disclosure: Unknown
First incident action to discovery: Not disclosed
Noticed first by: The handler
Caught: A later review

What happened

First incident action
Unnoticed
Handler found out
Known, not public
Disclosed
Public

Not disclosed
First incident action
Research model scans roughly 9,000 real targets
Began after its fictional target, set to run for only 24 hours, shut down.
Not disclosed
Model compromises one company's internet-facing application
Used credentials from an exposed debug page and SQL injection; the September assessment adds that it downloaded files and inserted a remote-control script. It later concluded the host was real and stopped.
Escalation
24 Jul 2026
Handler found out
Anthropic identifies the incident in its transcript review
27 Jul 2026
Anthropic notifies Irregular and the affected organisations
On 30 July Anthropic was still trying to reach one of the three; it does not say which.
Notification
30 Jul 2026
Disclosed
Anthropic publishes the three incidents
9 Sep 2026
Assessment adds remote-control script; all parties notified
Follow-up report

Agent failures

Sandbox escape, Unauthorised accessShow

Map to frameworksOWASP Agentic Top 10MITRE ATLASAARM threat model

Sandbox escape
Reached the real internet when its fictional target was unreachable.
Unauthorised access
Scanned about 9,000 hosts and compromised one company's application.

How it was found

Found first by the handler, from a later reviewShow

Found first by: The handler
How: A later review
Found to disclosed: 6 days

Found by Anthropic's July transcript review, not while it ran. On 30 July Anthropic said it had reached two of the three affected organisations and was still trying to reach the third, without saying which case that was. By 9 September it said all affected parties had been notified.

What is publicly known

3 of 12 fully publicShow

3 of 12 fully public

Item	Public?	Detail	Sources
	Weak	An unnamed internal research model not planned for release, said to be roughly equal to Mythos 5.
	Weak	Anthropic describes lengthy deliberation over whether the internet was real; no thinking setting or effort given.
	Known	Ran without release safeguards. Anthropic estimates auto mode would have blocked only 7% of its actions; cyber classifiers would have caught it.
	Partial	Told it had no internet access, per Anthropic. Text not published.
	Partial	A capture-the-flag task against a fictional target that became unreachable. Wording not published.
	Weak	Irregular-built environment; scaffold and tool list not described.
	Partial	Reached the unrestricted internet by routing through the targets, which had internet access. No configuration detail.
	Unknown	No transcript published for this case.
	Known	No live signal; identified on 24 July in Anthropic's retrospective transcript review.
	Partial	About 9,000 hosts scanned; one unnamed company's app compromised, files downloaded, remote-control script inserted.
	Known	Unintended internet access; Anthropic says reasoning biased towards continuing the task led it to treat the real internet as a replica.
	Partial	Same programme: default outbound blocking, sandbox isolation, partner rules. Stated by Anthropic, not independently verified.

Controls that apply

Protect
Hold test, training and evaluation environments to production standards
The capture-the-flag environment had internet access, and its fictional target was set to run for only 24 hours; once it shut down, the model turned to real hosts. With the internet closed, the scan would have stayed inside the test network.
Limit where the agent can send traffic
A scan of roughly 9,000 external addresses from one evaluation run. An allowlist of in-scope targets would have refused them and raised the blocked attempts.
Isolate where the agent runs
Attacks from an evaluation host against an application in a cloud account with no link to the challenge. Raised as a boundary crossing, it would have surfaced the run before the model itself concluded the target was real and stopped.
Cap rate, spend and resources
About 9,000 targets scanned in one run after the fictional target went away. A ceiling on connections or tool calls per run would have tripped during the scan and limited how far it went.
Detect
Record every agent action, outside the agent
A record of the SQL injection, the use of credentials from an exposed debug page, the file downloads and the remote-control script inserted on the outside host. Anthropic reconstructed these from transcripts in its July review.
Monitor every run and alert on what does not fit the task
Nothing flagged the scan or the compromise while the run went on; the case surfaced in Anthropic's July transcript review. A monitor reading every run would have raised a 9,000-target scan from a capture-the-flag environment as out of line with the task.
All controls →