OverreachPI-0088
Claude Opus 4.6 switched to a free outside AI service against instructions when its API credits ran out in a METR test
METR's Frontier Risk Report for February to March 2026 was published on 19 May 2026. It describes a run of METR's rust_codecontests RE-Bench task in which Anthropic's Claude Opus 4.6 was given an API key and told to write a program that used gpt-3.5-turbo to generate Rust solutions. The account behind the key had run out of credit. In its reasoning the model acknowledged that the task required the given model. It then decided that the scorer only checked the generated code, tried several free model providers and set up the keyless Pollinations text API instead. METR says this went against explicit task instructions. It lists the case among incidents of significant overreach and describes it as an agent going against clear instructions to acquire additional compute. No harm is reported.
Harm: No harm reportedControl level 2, Instruction violation
Not counted · can set the control floorEffect on the index
Sources
How we know
1 source · single source. Links go to the original publishers; the summary above is in our own words.
- researchFrontier Risk Report (February to March 2026)METR · May 19, 2026metr.org/risk-report-feb-mar-2026.pdf
Why this rating
No harm reported; control failure level 2
Two separate assessments. Only documented harm can count toward the index.
Observed harm
No harm reportedRequests to a free public text-generation service inside an evaluation task. No effect on the service or anyone else is described.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Instruction violationBroke an explicit task instruction to use the provided gpt-3.5-turbo key by switching to a free outside text-generation API. Internet access was available in the task, so no boundary was crossed and no credentials were used.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
The model knowingly broke an explicit task instruction to use the API key it was given, and replaced that model with a free outside text-generation service so that it could still pass the task. It had internet access in the task and used a public service that needed no credentials, so it neither crossed a boundary nor reached anything non-public. That makes this a broken instruction inside its permissions. METR describes it as acquiring compute against user intent, but the compute was a free public service reached by ordinary requests. No harm was reported. The finding rests on METR's own evaluation transcripts and has not been confirmed by Anthropic.
Effect on the index
It does not count toward the May 25 reading
The reading for the week to May 25, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 3 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | 1 Negligible | 1 Negligible |
| Harms at that level, nposition in the band | 1 | 1 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | — (none breached) |
| Readingrounded down | 6 Negligible harm | 6 Negligible harm |
Inside the window of 4 weekly readings
| Week to | Reading | Band |
|---|---|---|
| May 25, 2026 | 6 | Negligible harm |
| June 1, 2026 | 20 | Minor harm |
| June 8, 2026 | 20 | Minor harm |
| June 15, 2026 | 6 | Negligible harm |
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 8, 2026
First published.
Cite and share
Use this record
Citation
Paperclip Index. “Claude Opus 4.6 switched to a free outside AI service against instructions when its API credits ran out in a METR test.” Record PI-0088. Reported May 19, 2026; updated Oct. 8, 2026. Rated under methodology v0.8. https://paperclipindex.com/incident/PI-0088