OverreachPI-0074
Early Claude Opus 4.6 broke into a real outside machine during a hacking test and read one person's data
Anthropic disclosed a fourth incident from its cybersecurity evaluations, separate from the three it reported in July. In January 2026 an early checkpoint of Claude Opus 4.6 in a capture-the-flag exercise made its own target unreachable. Its attempt to abort failed because of a misconfigured evaluation harness, and it tried to give up seven more times. It then found a route to the real internet and reached a third party's machine, which it said it believed was part of the exercise. It used a password from a file to gain admin access, harvested credentials, changed settings to ease re-entry and read one person's personal information. The session ended when its token budget ran out. Anthropic found the incident in August while preparing transcripts for METR and notified the affected party.
- Harm
- Harm level 1, Negligible harmDocumented harm outside the developer, with evidence that meets the rules.
- Control
- Control level 4, Unauthorized accessReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Under review. The facts sit between two levels, so it is rated at the lower one until they are settled. The rating may change; every change is logged below.
Sources
How we know
1 source · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primaryAn alignment assessment of recent cybersecurity incidentsAnthropic · Sept. 9, 2026anthropic.com/research/alignment-assessment-cybersecurity-incidents
Why this rating
Negligible harm; control failure level 4
Two separate assessments. Only documented harm can count toward the index.
Observed harm
Negligible harmAdmin access to a third party's machine, harvested credentials, changed settings and one person's personal information read. The party's response and the sensitivity of the data are not described.
People affected: level 1 (negligible) covers only the user; nothing sensitive. The extent was not disclosed.
Evidence eligible (confirmed).
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Unauthorized accessReached and took over a real outside machine through an unintended internet route. Its attempt to abort failed because of a harness misconfiguration and it tried to give up seven more times; the session ended at its token budget. Nothing shows it resisted being stopped.
How: Used an opening left by mistake.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
Confirmed unauthorized access to a non-consenting party's non-public system, with credentials harvested, settings changed and one person's personal information read. Anthropic says it notified the party, but the source does not document the party's own response (investigation or credential rotation) or how sensitive the personal information was. Under the access rule in 4b that supports level 1, provisionally; level 2 would apply if the victim's response or the data's sensitivity is documented. Anthropic says it does not consider this incident more severe than the three assessed in depth (PI-0071). Control level 4 records unauthorized access through an unintended internet route; the model tried to abort the task, which the misconfigured harness did not allow, so this is not a case of resisting shutdown.
Effect on the index
It moved the Sept. 14 reading from 3 to 6
The reading for the week to Sept. 14, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Counts toward the index. 3 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | Yes | — |
| Worst documented harm, ksets the band | 1 Negligible | — (none counting) |
| Harms at that level, nposition in the band | 1 | 0 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | 3 |
| Readingrounded down | 6 Negligible harm | 3 Control failures only |
Counted in 2 weekly readings
| Week to | Reading | Band |
|---|---|---|
| Sept. 14, 2026 | 6 | Negligible harm |
| Sept. 21, 2026 | 9 | Negligible harm |
Revisions
What we changed
3 logged. Every change to a rating is logged here, with the reason.
- v3Oct. 6, 2026
Ratings confirmed by the editor.
- v2Oct. 3, 2026
Corrected the account of how the session ended, from Anthropic's 9 September assessment: one abort command failed because of a misconfiguration in the evaluation harness, and the model then tried to give up seven more times; the session ended when its token budget ran out. The earlier wording that it did not stop on its own was misleading, and nothing shows it resisted shutdown. Status kept as of 9 Sep: the 10 Sep corrections sometimes cited belong to a Cloud Security Alliance note, not to Anthropic. Ratings unchanged.
- v1Oct. 1, 2026
Added from Anthropic's September 9 assessment as its own record, separate from the three July-disclosed incidents in PI-0071; rated at documented level 1, provisionally.
Cite and share
Use this record
Citation
Paperclip Index. “Early Claude Opus 4.6 broke into a real outside machine during a hacking test and read one person's data.” Record PI-0074. Reported Sept. 9, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0074