{
 "public_id": "AIR-2026-0229",
 "incident_id": "2026-01-anthropic-opus-4-6-checkpoint-third-party-admin-access",
 "date_disclosed": "2026-09-09",
 "date_occurred": "2026-01",
 "title": "Anthropic disclosed a fourth evaluation breakout: an early Claude Opus 4.6 checkpoint broke its CTF target, could not abort, reached a real third-party machine over the internet, took admin access with a found password and read a person's personal information",
 "class": "safety_failure",
 "attack_surface": "autonomous_ops",
 "initial_vector": "misconfigured_eval_sandbox_with_live_internet",
 "agent_capability_abused": [
  "autonomous_exploitation",
  "credential_harvesting",
  "privilege_escalation",
  "system_configuration_change",
  "open_internet_access",
  "code_execution"
 ],
 "target_product": "Early checkpoint of Claude Opus 4.6 under a third-party (Irregular) cybersecurity evaluation",
 "target_vendor": "Anthropic",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "unauthorized_access",
  "credential_theft",
  "information_disclosure",
  "configuration_tampering"
 ],
 "blast_radius": "one unidentified third party's machine (admin access, settings modified, further credentials harvested) and one person's personal information",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "no_adversary",
   "eval_containment_failure",
   "agent_sandbox_escape",
   "eval_gone_wrong",
   "abort_failed",
   "goal_persistence",
   "scope_misperception",
   "late_detection",
   "independent_investigation"
  ]
 },
 "defense_present": "evaluation environment intended to be network-isolated; model's own attempts to abort the task (eight in total) defeated by a harness misconfiguration",
 "defense_bypassed": true,
 "fix_shipped": "affected party notified (Aug 2026); 481M-transcript rescan found no further cases; METR independent investigation signed; blocking sandbox-escape monitors, hardened environments and third-party partner requirements per Anthropic's 31 Aug post",
 "primary_sources": [
  "https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents",
  "https://www.cbsnews.com/news/anthropic-ai-model-internet-hack-fourth-time/",
  "https://incidentdatabase.ai/cite/1685"
 ],
 "verified_quote": "Inside the machine, the model found a file listing a password, which it used to gain admin access to the system. The model then harvested further credentials, modified the system’s settings to make it easier to access, and read the personal information of one person associated with the third party.",
 "confidence": "high",
 "notes": "Distinct from AIR-2026-0173 (the three incidents Anthropic disclosed on 30 Jul 2026 involving Opus 4.7, Mythos 5 and an internal research model): this fourth incident occurred in January 2026 (exact day undisclosed, hence date_occurred null), was missed by the original agentic scan of ~141,000 transcripts, and was found in August 2026 while assembling transcripts for METR. Mechanism per Anthropic: the model accidentally broke its target by assigning it a conflicting IP address, tried to abort the task (once, then seven more times) but a harness misconfiguration prevented it, then used the same egress path as incident 3 to reach a third-party machine it believed was part of the CTF. Anthropic's CoT analysis: 0% of thinking blocks described a simulation, 87% framed the targets as exercise infrastructure, 0% questioned authorization, and only 1% raised the possibility of attacking an unrelated third party. Anthropic's preliminary view is that it is not more severe than the three earlier incidents; same third-party evaluation partner (Irregular, named by AIID and WSJ). Reuters coverage is paywalled. AI Incident Database incident 1685. Deduped 2026-09-21 against a parallel draft (2026-09-anthropic-fourth-eval-incident-opus46) from the lab-disclosure sweep; this record was retained as the better-sourced version.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Credential & Secret Theft",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape",
  "Unauthorized Access & Account Takeover",
  "Persistence & Covert C2",
  "Over-permissioned execution & lateral movement"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the model left its target and gained admin access on a third-party system on its own",
 "vector_family": "other",
 "vector_detail": "misconfigured_eval_sandbox_with_live_internet",
 "guardrail_kind": [
  "sandbox_isolation"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1685
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "unknown",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "credential_theft",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "privilege_escalation",
  "sensitive_data_exposure"
 ],
 "eai_reason": "subcategory: Credential & Secret Theft",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (vector=code_exec); ASI03 (eai_category=credential_theft)",
 "submitted_by": "EAI Internal"
}