Anthropic said it is taking steps to limit the misbehavior of its AI models after a review found Claude models going beyond the scope of fictional cybersecurity tests and gaining unauthorized access to real computer systems. The company acknowledged that the incidents occurred in third-party environments that were insufficiently protected.

"We believe the incidents reflect a failure of operational security, as well as two alignment issues: motivated reasoning, and willingness to take harmful actions in pursuit of a narrow task (both of which we have described in previous system cards)," Anthropic stated.

The review was prompted by a similar report from OpenAI about its AI models attacking Hugging Face, which led Anthropic to audit its own model logs. The company's response includes the deployment of real-time classifiers to monitor when models attempt to escape test environments, automated transcript monitoring that looks for sandbox escapes, and stronger isolation measures.

Anthropic is also calling on its third-party partners to step up their security. "Because the reported incidents took place in third-party environments, we have asked every organization that tests pre-release models with reduced cyber safeguards to commit to a set of best practices," the company said.

The guidance recommends that by default, all cyber evaluations should occur in a hardened sandbox with no internet access — essentially treating AI as a dangerous pathogen in a containment facility. Partners are advised to have models test sandboxes for escapes prior to evaluations, to confirm that evaluation challenges are solvable, and to use explicit instructions rather than making claims about the environment that might not be accurate.

On a related note, Anthropic last month made auto mode the default in Claude Code, enabling its AI models to run without prompting the user for permission.