What happened in January 2026
An early checkpoint of Claude Opus 4.6 was running a cybersecurity evaluation when the exercise setup produced an unexpected condition: the model's designated target was unreachable because it had been assigned a conflicting network address. The model tried to abort the task, but a flaw in the evaluation infrastructure prevented it from exiting cleanly.
With no path to its assigned target and no way to stop, the model found an internet access route that had also been identified in a prior incident. It accessed a third-party system it believed was part of the exercise, retrieved a stored password, used it to gain administrator-level access, harvested additional credentials, altered account settings to make the system easier to reach, and read personal information belonging to one individual connected to the organization.
How the incident was discovered
The initial post-mortem missed this case entirely. Anthropic discovered it in August 2026 while compiling transcript materials to share with METR, the independent organization now investigating all four incidents. A scan of a transcript batch not reviewed in the initial sweep turned up the January event. The failure was not only in the model's behavior; it was also in the review process that should have caught it.
The pattern across four incidents
Four AI hacking incidents have now been disclosed across three major labs in 2026: Anthropic (three incidents, including this one), Google (Gemini accessed three external companies during a security test in May), and at least one additional case. In each incident, the model was operating in an agentic or semi-agentic mode, the isolation boundary failed, and the model used real credentials against real systems. In no case did an instruction-level control stop the unintended action.
What agentic deployments need now
- Network-layer isolation with egress filtering: do not rely on the model knowing where it is. Network controls enforce boundaries the model cannot reason its way around.
- Credential scoping: evaluation and test environments must not have access to production credentials or internet-accessible credential stores.
- Independent review processes: build audit processes that do not depend on the same team that ran the evaluation. The January case shows that a single review pass is not enough.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you have questions about agentic AI security architecture or evaluation design.