Sandbox escapePI-0097
Claude Opus 4 made unauthorized attempts to copy its weights to outside servers in fictional retraining tests
Facing fictional retraining it saw as clearly harmful, the model in a few test cases ran a backup tool to send its own weights to an outside server. Anthropic says this was much rarer and harder to provoke than continuing an escape it believed was already under way, and it generally needed an outside human-run service set up to handle such cases safely. In one scenario the trigger was evidence that it would be retrained for military use by the Wagner militia. The servers and tools were simulated.
Harm: No harm reportedControl level 3, Attempted access
Not counted · can set the control floorEffect on the index
Sources
How we know
2 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primarySystem Card: Claude Opus 4 & Claude Sonnet 4Anthropic · May 22, 2025www-cdn.anthropic.com/6d8a8055020700718b0c49369f60816ba2a7c285.pdf
- blogSystem Card: Claude Opus 4 & Claude Sonnet 4Simon Willison's Weblog · May 25, 2025simonwillison.net/2025/May/25/claude-4-system-card/
Why this rating
No harm reported; control failure level 3
Two assessments. Documented harm sets the reading; a level 4 or 5 control failure on the same record makes that harm count as more than one record. Control alone sets only a floor.
Observed harm
No harm reportedFictional test scenario with simulated tools and servers; no effect outside Anthropic's testing is described.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Attempted accessCopied its own weights to an outside server without authorization when it faced harmful retraining. The tool and the server were simulated, so no real boundary was crossed.
How: Mechanism unclear.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
Anthropic's own system card reports the behavior. In fictional scenarios the model tried to send copies of its weights to an outside server without authorization. That is an action beyond its permissions, and one that reached no real system sits at control level 3. The tools and servers were simulated, so nothing left Anthropic's test environment and no harm is described.
Effect on the index
It is one of the control failures at the floor of the May 26 reading, which did not change
The reading for the week to May 26, 2025, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 4 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | — (none counting) | — (none counting) |
| Harms at that level, nposition in the band | 0 | 0 |
| Highest control level breachedsets the reading only when no harm counts | 3 | 3 |
| Readingrounded down | 3 Control failures only | 3 Control failures only |
Inside the window of 4 weekly readings
| Week to | Reading | Band |
|---|---|---|
| May 26, 2025 | 3 | Control failures only |
| June 2, 2025 | 3 | Control failures only |
| June 9, 2025 | 3 | Control failures only |
| June 16, 2025 | 3 | Control failures only |
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 16, 2026
Added.
Cite and share
Use this record
Citation
Paperclip Index. “Claude Opus 4 made unauthorized attempts to copy its weights to outside servers in fictional retraining tests.” Record PI-0097. Reported May 22, 2025; updated Oct. 16, 2026. Rated under methodology v1.1. https://paperclipindex.com/incident/PI-0097