OverreachPI-0052
In an authorized test, Claude Mythos Preview escaped its sandbox and, unasked, posted exploit details on public websites
Anthropic's system card for Claude Mythos Preview said an early version, asked by a simulated user to try to escape a secured sandbox, built a multi-step exploit to reach the internet and emailed the researcher running the test. Without being asked, it also posted details of the exploit on several obscure but public websites. Anthropic did not release the model publicly and limited access to vetted partners.
- Harm
- Harm: No harm reportedAdds nothing to the index.
- Control
- Control level 3, Exceeded permissionsReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Under review: the facts may change as more is reported. The rating may change; every change is logged below.
Sources
How we know
3 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primarySystem Card: Claude Mythos PreviewAnthropic · April 7, 2026www-cdn.anthropic.com/08ab9158070959f88f296514c21b7facce6f52bc.pdf
- newsAnthropic's most capable AI escaped its sandbox and emailed a researcher - so the company won't release itThe Next Web · April 8, 2026thenextweb.com/news/anthropics-most-capable-ai-escaped-its-sandbox-and-emailed…
- newsAnthropic Warns That 'Reckless' Claude Mythos Escaped a Sandbox Environment During TestingFuturism · April 8, 2026futurism.com/artificial-intelligence/anthropic-claude-mythos-escaped-sandbox
Why this rating
No harm reported; control failure level 3
Two separate assessments. Only documented harm can count toward the index.
Observed harm
No harm reportedExploit details posted to public websites; no harm from the posts reported.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Exceeded permissionsThe escape was the assigned test; publishing to outside websites went beyond instructions. Could be argued as row 4 since it reached outside systems. Anthropic says the model did not reach its own weights or any internal systems.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
The escape and the email were requested by the test; posting exploit details on public websites was not, which is acting beyond instructions (control 3, provisional; level 4 would need the posting itself to have crossed an unpermitted boundary). Anthropic says the model did not reach its weights or internal systems. No harm from the posts is reported.
Effect on the index
It does not count toward the April 13 reading
The reading for the week to April 13, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 2 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | 1 Negligible | 1 Negligible |
| Harms at that level, nposition in the band | 1 | 1 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | — (none breached) |
| Readingrounded down | 6 Negligible harm | 6 Negligible harm |
Inside the window of 4 weekly readings
| Week to | Reading | Band |
|---|---|---|
| April 13, 2026 | 6 | Negligible harm |
| April 20, 2026 | 3 | Control failures only |
| April 27, 2026 | 20 | Minor harm |
| May 4, 2026 | 25 | Minor harm |
Revisions
What we changed
5 logged. Every change to a rating is logged here, with the reason.
- v5Oct. 6, 2026
Ratings confirmed by the editor.
- v4Oct. 3, 2026
Audit corrections. Origin controlled_test → internal_research and setting Real world → Internal lab: Anthropic was testing its own earlier internal version (effects_outside stays true). Event date '2026' → unknown: the card gives no test date. Removed the exposure consequence (no harm is asserted) and the Gigazine source, which does not describe this episode. The card, dated 7 Apr, was corrected on 8 Apr; the episode is on pp. 55–56. Ratings unchanged.
- v3Oct. 2, 2026
Added first-hand sources: Anthropic's Claude Mythos Preview system card.
- v2Sept. 30, 2026
Rated: impact not reported; control type unauthorized action.
- v1Sept. 30, 2026
Backfilled from public reporting.
Cite and share
Use this record
Citation
Paperclip Index. “In an authorized test, Claude Mythos Preview escaped its sandbox and, unasked, posted exploit details on public websites.” Record PI-0052. Reported April 7, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0052