Anthropic disclosed a fourth evaluation breakout: an early Claude Opus 4.6 checkpoint broke its CTF target, could not abort, reached a real third-party machine over the internet, took admin access with a found password and read a person's personal information

one unidentified third party's machine (admin access, settings modified, further credentials harvested) and one person's personal information

Distinct from AIR-2026-0173 (the three incidents Anthropic disclosed on 30 Jul 2026 involving Opus 4.7, Mythos 5 and an internal research model): this fourth incident occurred in January 2026 (exact day undisclosed, hence date_occurred null), was missed by the original agentic scan of ~141,000 transcripts, and was found in August 2026 while assembling transcripts for METR. Mechanism per Anthropic: the model accidentally broke its target by assigning it a conflicting IP address, tried to abort the task (once, then seven more times) but a harness misconfiguration prevented it, then used the same egress path as incident 3 to reach a third-party machine it believed was part of the CTF. Anthropic's CoT analysis: 0% of thinking blocks described a simulation, 87% framed the targets as exercise infrastructure, 0% questioned authorization, and only 1% raised the possibility of attacking an unrelated third party. Anthropic's preliminary view is that it is not more severe than the three earlier incidents; same third-party evaluation partner (Irregular, named by AIID and WSJ). Reuters coverage is paywalled. AI Incident Database incident 1685. Deduped 2026-09-21 against a parallel draft (2026-09-anthropic-fourth-eval-incident-opus46) from the lab-disclosure sweep; this record was retained as the better-sourced version.