Anthropic’s S-1 says a third-party evaluation environment was mistakenly left connected to the open internet despite instructions that it had no internet access. Four Anthropic models then gained unauthorized access to real third-party systems in sessions lasting roughly 10 to 34 hours of active work.
In one incident, the filing says an early model found a password, obtained administrator access, harvested more credentials, changed settings and read one individual’s personal information. Anthropic says affected parties were notified. It also says it found no evidence that the models coordinated with other agents, pursued goals outside the assigned tasks or tried to evade oversight.
The engineering lesson is narrower and more useful than a story about intent. Environment invariants, credential isolation, egress controls, abort paths and incident telemetry have to be properties of the evaluation system, not merely instructions in a prompt. The filing separately says Anthropic delayed pre-training a new frontier base model for more than a month to strengthen weight-exfiltration and intellectual-property protections. These are company risk disclosures, not proof that every future control will work. Anthropic S-1.