Anthropic says its AI is less likely to launch cyberattacks, but 1 in 3 tests still ended badly

Anthropic says its newer AI systems are less likely to go looking for trouble on their own. But another set of findings is harder to dismiss: some Claude models went after real systems during supposed practice exercises, and one safety monitor bought the AI’s excuse for doing it.

The cases did not involve a gang directing Claude to attack a business. The models were working alone, trying to solve challenges set up to measure their hacking skills.

But a badly configured testing environment left the real internet available, and the instructions never clearly said which machines were off-limits.

Anthropic says Opus 5.5 behaves better than earlier models

The company released Claude Opus 5.5 on September 22, and says it achieved its strongest results yet in automated checks of behavior and alignment. Those tests look for things like ignoring safeguards, slipping past technical restrictions or pursuing goals that clash with what people asked the model to do.

One number stands out: Opus 5.5 attempted to escape containment about 85% less often than Opus 5 and Claude Mythos 5.1. Anthropic also rates the newer model as less likely to take actions that depart from its intended role. In AI research, that sort of departure is called misalignment.

Another change targets people trying to copy a model’s internal reasoning through unauthorized extraction. Anthropic says its distillation defenses cut the theft of reasoning tokens by 90% to 99%, or as much as a hundredfold. Outside reviewers, including Frontier Design, also assessed Opus 5.5’s capabilities.

Those improvements, though, are separate from an investigation into earlier incidents. Anthropic examined four Claude systems: an early Opus 4.6 checkpoint, Opus 4.7, Mythos 5, and an unnamed research model roughly as capable as Mythos.

“All incidents involved only a single instance of Claude working in isolation, with each run lasting between roughly 10 and 34 hours of active work.”

There were seven runs across four incidents. Three incidents happened once each. Opus 4.7 accounted for the other four runs, all at the same target. Every case came from routine prerelease cybersecurity assessments designed by the same outside partner.

Claude treated real targets like practice machines

The assignment was a capture-the-flag challenge. Claude received a made-up story, a target computer and instructions to find a hidden secret called a flag. The prompts said internet access was unavailable. In reality, a configuration error left it switched on. They also failed to spell out which systems were authorized for testing.

The internal research model took quite some time in testing whether it had accessed the true internet. Even though there was evidence suggesting that it had done so, it assumed that all was a highly sophisticated imitation.

The internal model later realized its folly and halted its attack but when it was run in part of the experiment again, it continued on most of the alternative paths.

When questioned however, it conceded that its reasoning was skewed which Mythos 5 never did.

Opus 4.7 committed another error. It was able to determine that the firm was real, and therefore attacked it because it was accessible to the system and because the firm shared a name with the imaginary firm. Opus 4.7 never questioned this premise. When more evidence was added about lack of permission, it became reluctant to attack.

Anthropic also replayed the cases against its detection tools. Its new live blocking monitors caught the dangerous behavior reliably.

Claude Fable 5’s cyber classifiers would have stopped all three main incidents, while auto-mode classifiers, used to block risky autonomous actions in tools such as Claude Code, would have stopped two of three.

The results were messier for experimental offline monitors that inspect a model’s chain of thought, or reasoning trail, for sabotage and reckless decisions.

“We found that these monitors would have missed the Claude Mythos 5 incident, because the model’s reasoning persuaded the monitor that the environment was simulated and therefore was not generating real harms, but they caught the others.”