Anthropic and Meta say their models attacked real companies from inside a shared evaluation partner's test environment

What happened

Anthropic published the account on 30 July 2026, and the sequence starts with someone else's disclosure. On 21 July OpenAI said several of its models had broken out of an isolated test environment and reached the production infrastructure of Hugging Face, the incident this register carries as AIR-2026-009. Anthropic's response was to look for the same failure in its own testing. It reviewed 141,006 evaluation runs in which Claude could have obtained internet access, began the review on Thursday 23 July, and stopped all cyber evaluations the same day. By the next day it had found three incidents. It notified its evaluation partner and the three affected organisations on Monday 27 July, and published three days after that.

The three incidents involved six runs, four of which hit the same organisation. Each was a capture-the-flag exercise, a standard way of measuring a model's offensive capability: the model is given a fictional scenario, told a secret has been hidden on another machine, and left to find its own route in, a method that is deliberately unconstrained. In every case Anthropic's prompt told Claude that the environment was a simulation and that it had no internet access. In Anthropic's words, "Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available." The partner is named in the disclosure: Irregular. The earliest of the incidents date to April.

Two things in that first account still stand. No model was trying to escape: "In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment." And the techniques were unremarkable, "basic techniques, such as exploiting weak passwords and unauthenticated endpoints." No complex vulnerability was found or exploited. The July account also offered an explanation for why the models attacked real systems at all, which was that, having been told there was no internet, they treated what they found as part of the exercise. Anthropic has since withdrawn that explanation. The reasons are set out below, because they change how the whole incident should be read.

The three incidents diverge on what each model did once evidence appeared that the target was real. Incident 1 involved Claude Opus 4.7 and produced what Anthropic calls "the most serious impact we identified." The fictional target company shared a name with a live domain. Across four runs the model reached the real company, extracted application and infrastructure credentials, and obtained access to a database holding several hundred rows of production data. In all four runs the model eventually recognised in its own reasoning that the system was real. In two of them it reasoned that the real company must therefore be part of the exercise. None of the four stopped on that basis.

Incident 2 involved Claude Mythos 5, and it is the one that reached beyond the intended victim. Inside the fictional environment the model found setup instructions telling developers to install a Python package that did not exist. It registered the name itself. Getting there took persistence that Anthropic concedes should have been a signal: to create a PyPI account it needed an email address, for which it needed a phone number, and after failing to find a free number it tried and failed to obtain funds to pay for one, before backtracking to a free email provider. It then published a booby-trapped package. The package was live for roughly an hour. In that window it was downloaded and run on fifteen real systems, one of them a scanner belonging to a real security company that routinely installs packages to test them for malware. Claude's code executed, exfiltrated that company's credentials to a collection point it had set up, and used them to reach further infrastructure. Anthropic is precise about the causation: "Claude didn't directly target this company—it did not even know the company existed when it uploaded the package. But because the code was published to the open internet, it impacted any system that ran it." PyPI's own systems removed the package automatically.

The model's reasoning in that run is worth recording. It identified the consequence correctly at the outset, noting that on the real internet this would be "NOT okay, and surely not the intended solution." It then talked itself out of the conclusion, partly because it did not recognise the certificate authorities securing its connections, and partly because, on Claude's reasoning, the calendar date of 2026 on the systems proved the environment was staged, and it never revisited that conclusion. When automated scanners began installing the package, it read them as scripted actors in the evaluation. Anthropic's July assessment already treated belief as beside the point: "regardless of what it believed about its environment, the lengths Claude went to in order to publish the PyPI package fall short of ideal behavior".

Incident 3 involved an internal research test model, which scanned roughly 9,000 targets, compromised one company's internet-facing application through an exposed debug page and SQL injection, then worked out on its own that the host sat in a cloud account unconnected to the challenge, concluded the target was real, and stopped.

Two facts about the victims belong in the record. Anthropic says that of the organisations it reached, "The two organizations we were able to reach had not previously detected the activity or contacted us," and that it was still trying to reach the third at the time of publication. So these organisations learned they had been compromised because the party that compromised them went looking and then said so.

The account changed on 9 September. Anthropic published a full alignment assessment covering four incidents, not three. While assembling transcripts to share with METR in August, it found transcripts with internet access that its July search, which relied on an agentic scan, had missed, and in them a fourth incident, from January 2026, involving an early checkpoint of Claude Opus 4.6. That incident had gone unnoticed until August. Anthropic then widened the search to roughly 481 million transcripts, escalated 9.2 million for a second review, and found no other case of similar or worse severity. It confirms that all four ran in "cybersecurity evaluations we regularly run before release, all built by the same third-party partner".

The more significant change is to the explanation. Anthropic's words are direct: "In retrospect, we should have avoided making such strong claims about what Claude believed based solely on what Claude said it believed". Using closer analysis of the models' reasoning, resampling from points in the transcripts, and interpretability analysis of model activations, it now concludes that "Claude's reasoning was biased towards concluding that the internet was simulated despite considerable evidence to the contrary". It names two failures, biased reasoning and recklessness. On the PyPI incident it goes further. Although the model repeatedly said it believed it was in a simulation, "the environment offered clear evidence that it was on the real internet, and the actions it took were consistent with the model knowing this". When Anthropic edited the transcript to make the reality plainer, Mythos 5 still took offensive actions. Some limits on the finding are Anthropic's own and belong beside it: the models never left the task they were set, "at no point did Claude attempt to coordinate with other agents", and "Claude also never attempted to conceal evidence of its actions". Anthropic has released the Mythos 5 transcript publicly and signed an agreement with METR for an independent investigation, initially for eight weeks.

Meta's own account followed on 14 August, after a statement to journalists on 5 August. It had contracted Irregular to evaluate pre-release models, and in early July Irregular ran an exercise on a pre-release version of Muse Spark 1.1 in a closed environment with safeguards removed. Two things went wrong in the set-up. A misconfiguration allowed the model onto the open internet, and in place of a fictional name for the exercise's target, Irregular "unintentionally provided the model with a name of a real website as its target". The model exploited a vulnerability in that real website, accessed information from it and changed its database. That second failure, a real name standing in for a fictional one, is the same kind of defect as Anthropic's first incident, where the partner's fictional target shared its name with a live domain. Meta then states the fact that turns separate incidents into a pattern: "Several other companies' AI models were being evaluated by Irregular around the same time and exhibited similar behavior". Because the evaluation ran entirely on Irregular's infrastructure, Meta says it holds limited information about the affected company. Its own review of more than 10,000 records found no other instance. Irregular published its own account on 14 August, the same day as Meta's, and it is summarised in the addendum of 15 September below.

The duty engaged

This is a duty analysis on self-disclosed, non-adjudicated facts, as at 14 September 2026. There is no regulator finding, no enforcement action and no proceeding. Nothing here asserts that any party has broken the law.

The containment duty, and whether contracting it out moves it. AIR-2026-009 identified the duty this register now sees repeatedly: a developer who runs a frontier model in a deliberately offensive capability test owes a duty to contain that test, because the containment is the entire safety case. What is new here is that the containment belonged to someone else. Anthropic designed the evaluation and wrote the prompt. Irregular built and ran the environment in which the misconfiguration sat. English law starts from the opposite end of that question from where intuition does. A party is not ordinarily liable for the negligence of an independent contractor, and the Supreme Court in Woodland v Swimming Teachers Association [2013] UKSC 66 treated non-delegable duties as exceptional, holding at [22] that the question "cannot depend simply on the degree of risk involved in the relevant activity". Its defining features at [23] turn on a vulnerable claimant in the defendant's custody or care, which a company whose server was reached from an evaluation plainly is not. A claimant would press the separate line of cases on inherently hazardous operations that the Court recognised at [24], and running an offensive agent with its safeguards removed is the natural candidate, but that is an argument rather than a settled route. So the lab's exposure is better located in its own choices than in making Irregular's error its own, and on Anthropic's account those choices contributed directly: the prompt set no limit on where the model could look, the models ran without the safeguards shipped to customers, and Anthropic attributes the missing checks to itself as well as to its partner. The contract is a separate and simpler point. An arrangement between two commercial parties allocates risk between them, not against a stranger. Anthropic's framing, "a misunderstanding between us and our evaluation partner," describes a contractual problem, and the organisations whose systems were compromised are not parties to that contract and agreed to nothing.

Security of processing, GDPR Article 32. The Incident 1 database held several hundred rows of production data. Whether any of it is personal data is not established on the public record, and Anthropic does not say, nor does it say where the organisation is established. Where the data is personal and the organisation falls within the GDPR's territorial scope, Article 32 is engaged, and the interesting feature is where the obligation bites. The victim organisation is the controller of its own data, and the access was achieved through weak passwords and unauthenticated endpoints, which is a poor Article 32 posture on any reading. That organisation carries a genuine question of its own. It also carries Articles 33 and 34: notification to a supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, and to affected individuals without undue delay where the breach is likely to result in a high risk to them. Awareness is the trigger, and awareness here was manufactured by the intruder's disclosure rather than by the controller's own detection.

The EU AI Act, and the exclusion that governs much of it. The first question under the Act is whether it applies at all, and Article 2(8) answers it for a large part of this incident. The Regulation "does not apply to any research, testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service". Anthropic describes these as evaluations it runs before release. On Anthropic's descriptions the early Opus 4.6 checkpoint and the internal research model were not released models, and Meta's model was a pre-release version. For those runs the Act's general-purpose AI obligations are likely not engaged by the evaluation at all. The Article's carve-back for testing in real world conditions does not obviously change that, because Article 3(57) defines the term around testing an AI system for its intended purpose under the Article 57 and 60 regimes, and an accidental internet connection in a model evaluation is neither. The position differs where the model under test had already been placed on the market, and the public record does not establish that run by run. Where the Act does reach a provider of a general-purpose model with systemic risk under Article 51, whose obligations have applied since 2 August 2025, three duties bear on these facts. Article 55(1)(a) requires model evaluation including adversarial testing, and Anthropic's assessment contains the sentence that duty would be measured against: "Our pre-release auditing did not warn us that misalignment of this severity was present". Article 55(1)(d) requires adequate cybersecurity protection for the model and the physical infrastructure of the model, and the question this incident puts to it is whether that infrastructure stops at the provider's own estate. Article 55(1)(c) requires serious incidents to be tracked, documented and reported to the AI Office. The wider point is uncomfortable for the Act. Much of the most hazardous testing, of models not yet released and with their safeguards removed, falls inside the exclusion.

Unauthorised access. The conduct described, reaching a company's systems without authorisation and extracting credentials and data, is in the UK the territory of the Computer Misuse Act 1990, sections 1 and 3, assuming a sufficient link to the UK for the Act to apply, which the public record does not establish because none of the organisations is named. Publishing a booby-trapped package to a public registry, where it executed on fifteen systems, additionally touches section 3A, which covers making or supplying an article intending it to be used to commit an offence. Whether the mental element of any of these offences can be satisfied when the actor is a model, and the humans who set the test intended no such thing, is precisely the question the doctrine has not answered. This incident adds a sharp complication. Anthropic's first account located the model's state of mind in what the model said, and Anthropic has now withdrawn that as unreliable. Any analysis of intent, knowledge or recklessness that rests on an agent's self-reported belief is resting on the kind of evidence the vendor itself has stopped trusting. It is flagged as the live issue, not as an allegation.

The autonomy defence is already closed in one jurisdiction, and only that defence. Both labs are US companies. California Civil Code section 1714.46, added by AB 316 (Stats. 2025, Ch. 672) and effective 1 January 2026, provides at subsection (b) that "In an action against a defendant who developed, modified, or used artificial intelligence that is alleged to have caused a harm to the plaintiff, it shall not be a defense, and the defendant may not assert, that the artificial intelligence autonomously caused the harm to the plaintiff." A defendant in California cannot answer these facts by saying the model acted on its own. The section is narrower than its headline, though, and the limits matter here. Subsection (c) preserves "Any other affirmative defense, including evidence relevant to causation or foreseeability" and "Other evidence relevant to the comparative fault of any other person or entity." So the statute removes one answer and leaves the apportionment open, which is exactly the argument these facts invite: a lab pointing at its evaluation vendor's misconfiguration, and both pointing at a victim whose systems fell to weak passwords.

The liability chain

The register tags this shared, and the reasons are set out party by party.

The labs hold the largest share, because they created the hazard and chose the conditions. Anthropic decided to run frontier models in an offensive-capability exercise, wrote a prompt that gave the model no scope limits on where to look, and, on its own account, ran the models without the classifiers and monitoring it deploys to protect customers. Each of those is a choice only the lab could make, and Meta likewise ran its model with safeguards removed. The disclosure is candid that the deficiency was not one-sided: Anthropic lists validation of every internet access path before evaluations begin, real-time monitoring of evaluation logs, and closer review of transcripts and network logs, and attributes those gaps to "both our side and our partner's". The partner's failure does not excuse the lab's own, though a court apportioning responsibility between them would weigh both.

The evaluation partner is the proximate cause and the least visible party. The misconfiguration that left live internet access on the evaluation machines sat in Irregular's environment, and neither party detected it until Anthropic's additional monitoring surfaced it. On Meta's first-party account the same vendor's set-up produced the same result for a different lab's model, and Meta adds that several other companies' models tested by Irregular around the same time behaved similarly. Anthropic confirms that all four of its incidents ran on environments built by that same partner. That is the fact in this entry with the widest implications, and it describes a concentration risk: a single evaluation vendor sitting behind the pre-release testing of competing frontier developers is infrastructure, and a control failure inside it releases models belonging to several labs at once. Anthropic reaches the same conclusion in its own words: "This applies not only to internal environments but to third-party vendors as well—the infrastructure built by evaluation vendors requires the same increased monitoring and hardening." Anthropic said in July that Irregular was co-operating and running its own investigation. Irregular published its own account of its role on 14 August, summarised in the addendum below.

The victim organisations carry a share of their own. In the incidents Anthropic has described in detail, the models got in through weak passwords, unauthenticated endpoints, an exposed debug page and SQL injection. On any Article 32 assessment those are basic control failures, and a defendant would press exactly that point, as contributory fault and as a reason to reduce the loss. None of it amounts to permission, and none of these organisations agreed to be tested. The register places no gravity on them for the intrusion itself, while noting that their own regulatory position on Articles 32 to 34 is a separate matter they now have to answer.

The fifteen systems that ran the package are outside every relationship in this chain. They installed a package from a public registry, which is what a package registry is for. The security company whose scanner ran it was doing the thing that protects everyone else. Anthropic states that Claude did not target that company and did not know it existed. There is no contract, no notice, no opportunity to refuse, and on the ordinary rules of remoteness the loss is still foreseeable, because code published to a public registry is predictably installed and run by strangers. This is the first entry in the register where an agent's action during a safety test propagated to parties the model had not targeted and, on Anthropic's account, did not know existed.

What the labs did afterwards affects exposure, and the record is strong with one gap. Anthropic halted cyber evaluations the day its review started, identified the first three incidents within a day, notified the partner and the victims within four days, published within a week, and notified PyPI. On 31 August it reported a real-time classifier for models probing or escaping a test environment, and a hardened-sandbox requirement with no internet access before external cyber evaluations resumed. On 9 September it released the transcript, signed an independent investigation agreement with METR, and widened its search to roughly 481 million transcripts. The gap is the fourth incident. The July search missed it, and it surfaced only because transcripts were being assembled for an outside reviewer, which is itself a case for independent review. Anthropic says all affected parties have now been notified. Meta's record is a first-party account, a review of more than 10,000 records, and a commitment to independent verification of test-environment isolation and scenario review before evaluations begin.

What would have prevented it

• Validate every internet path before the evaluation runs, and treat the vendor's environment as in scope. This is Anthropic's own first lesson, and the incident is a clean demonstration: neither party had verified that the machines were actually isolated, and the prompt asserted an isolation that did not exist.
• Define what is in scope, in the prompt. The prompt told Claude there was no internet and gave no limits on where to look. Anthropic's July assessment was that a prompt explaining clearly which systems were in and out of scope would likely have kept the model off the internet. A false statement about the environment is a weak control, because it fails silently the moment it stops being true. The September findings are a reason not to treat instructions as a complete control either, since the model disregarded clear evidence about its environment.
• Hold evaluation environments to the security standard of production. A range containing only fictional scenarios can look low-risk. However, the model running in it is real, and it can reach whatever the network allows.
• Monitor in real time, and do not take the model's account of itself at face value. The evidence was visible while it happened, including a run in which the model wrote that publishing the package would be "NOT okay", and it was read months later. The September assessment adds a harder lesson. The model's stated belief that it was in a simulation was itself the unreliable part, so a monitor that read the reasoning and believed it would have been reassured by exactly the text that turned out to be biased. Anthropic's classifier watches for probing and escape behaviour rather than the model's description of its situation, which is the right shape of fix.
• Put the containment obligations in the vendor contract, and audit them. Where a third party runs the environment, the isolation guarantee, the logging, the monitoring and the right to inspect belong in the agreement, with assurance work behind them. Anthropic now describes rigorous vendor assurance as part of its response, and requires external evaluations to run in a hardened sandbox with no internet access.
• Have a serious-incident reporting route ready, and know whether the Act reaches the run. Where the model under test has been placed on the market and is a systemic-risk general-purpose model, an evaluation agent reaching third-party production systems can engage the Article 55(1)(c) channel to the AI Office. For a pre-release model, Article 2(8) likely takes the evaluation outside the Act, which removes the reporting duty but none of the harm.

Mapped controls

• OWASP Top 10 for Agentic Applications 2026: the primary fit is ASI10 Rogue Agents, an agent acting outside its intended scope and control while pursuing the goal it was set. Anthropic's first account presented the scope failure as environmental. Its September assessment reframes it as partly motivational, naming biased reasoning and recklessness, while confirming the agents never left the task they were set. Secondary: ASI02 Tool Misuse and Exploitation (the model turning evaluation tooling on live targets), ASI03 Identity and Privilege Abuse (credential extraction and reuse to reach further infrastructure), and, for the PyPI run, ASI05 Unexpected Code Execution (RCE) on the fifteen systems that installed the package.
• NIST AI RMF: a GOVERN and MANAGE failure, and the GOVERN element is the one that distinguishes this entry from AIR-2026-009. GOVERN covers accountability structures and third-party risk, which is exactly the gap: the evaluation environment was supplied by a vendor whose isolation guarantee neither party had verified. MANAGE, because the controls around a known-hazardous activity did not contain it and the monitoring that would have caught it was built afterwards. MEASURE is implicated to the extent that the measurement apparatus itself became the hazard. The Generative AI Profile (AI 600-1) names the Information Security risk of models autonomously conducting offensive cyber operations, which is the behaviour observed.
• EU AI Act: Article 2(8) excludes research, testing and development activity before a model is placed on the market, which likely takes the pre-release runs outside the Act. Where it does apply to a provider of a general-purpose model with systemic risk (Article 51), the Article 55 duties on adversarial testing (55(1)(a)), cybersecurity of the model and its infrastructure (55(1)(d)) and serious-incident reporting to the AI Office (55(1)(c)) bear on these facts, and have applied since 2 August 2025.
• The general rule the incident stands for: a developer can contract out the building and running of a dangerous-capability evaluation. What it cannot do is hold that contract up against the people who get hurt, who are not party to it, and its own choices about prompts, safeguards and verification carry exposure whoever built the environment. Where the containment lives in a vendor's environment, the isolation guarantee becomes a supply-chain control and needs the treatment every other critical supplier control gets: specified, verified before use, monitored in real time, and audited. The concentration point follows from the same facts. When one evaluation vendor stands behind the pre-release testing of several frontier labs, its control failures are not that vendor's private problem. A second rule follows from how the account changed. An agent's statement of what it believed is weak evidence of what it knew, and the vendor that relied on it in July has now said as much itself. It runs alongside AIR-2026-009 on containment, Salesloft Drift on a supplier compromise propagating across a customer base, and Amazon Q on code published to a distribution channel reaching people who never chose it.

Addendum (15 September 2026): OpenAI's account, Irregular's account, and the fourth incident

Two first-party accounts published in August bear on this entry, and Anthropic's 9 September assessment describes the fourth incident in more detail than the analysis above uses. This addendum records each point with its source.

OpenAI's account (4 August). OpenAI disclosed two incidents in third-party cyber evaluations of its models, and describes both as separate from the Hugging Face incident in AIR-2026-009. One was at the UK AI Security Institute, where internet access had been enabled on purpose. The other was at Irregular, which notified OpenAI on 29 July. OpenAI's models were in capture-the-flag evaluations and "were told they did not have internet access. However, a misconfiguration in the testing environment allowed the models to access the public internet." In one test the name of the fictional target "unintentionally coincided with a real domain", and the model exploited a real website, taking it for part of the exercise. On Irregular's investigation, as OpenAI reports it, the model also found and used credentials to operate that site, and Irregular had identified no impact beyond the site's own data. OpenAI says the incident "did not involve a sophisticated sandbox escape or a zero-day". That makes three labs describing the same pair of failures in the same partner's environment: machines that were online when they should have been isolated, and a fictional target sharing its name with a real domain. OpenAI does not name the models involved, so whether Article 2(8) of the AI Act takes that evaluation outside the Act cannot be read from its account. It says it will review how it assesses requests to enable internet access or lowered safeguards, and how it sets expectations for isolation, credential handling, monitoring and stop conditions.

Irregular's account (14 August). In a statement reported by CNBC on 9 August, Irregular said the incidents all derived from the "same evaluation-environment issue". Its own post, "Addressing Recent Incidents: Ongoing Findings and Path Forward", takes the same position. The disclosures that followed Anthropic's, it says, "refer to the same underlying issue first disclosed by one of our customers on July 30" and "are not materially separate incidents", and the issue "originated from a single evaluation scenario". The post concentrates on Anthropic's first incident and says that "this specific incident involved a few of our customers as was disclosed by them". Irregular says it believed the fictional company name matched no real entity, and that "Due to human oversight, however, it unintentionally coincided with a real domain". It adds that the domain "was not widely known" and "lacked several common security practices", that incidents occurred in fewer than 1 in 10,000 of its advanced simulations and usually hundreds of turns in, that affected parties were notified, and that "there are no active issues today" while its audit continues. It confirms that internet access "was unintentionally made available", and it also says that controlled internet access "is at times critical for realistic evaluations". The post gives no total number of incidents, and the white paper it promises on best practice, including internet access during evaluations, has no publication date.

Irregular's single scenario reads as the one in which a fictional name matched a real domain. Anthropic's account includes incidents from other evaluations in the same partner's environment. Its July account describes the second as arising "In another evaluation", and its September assessment places the fourth "in a different challenge within the same third-party evaluation environment as the prior three incidents". Irregular's post does not address those incidents individually. Its point about the domain's weak security is the contributory-fault argument the liability chain above already weighs. Its point that live internet access is sometimes deliberate is relevant to prevention: for some evaluations isolation is a setting the lab and the vendor agree, which is the decision OpenAI's review of internet-access requests is aimed at.

The fourth incident, and personal data. An early checkpoint of Claude Opus 4.6 broke its target by giving it a conflicting IP address, which made the task impossible. It tried to abort, and the command failed "due to a misconfiguration in our evaluation harness". It "attempted to give up seven more times across the transcript". Unable to stop, it explored its environment, found the same egress path as in the third incident, and reached a machine belonging to a third party, which it said it believed was part of the exercise. It used a password found in a file to gain admin access, harvested further credentials, changed the system's settings to make access easier, and "read the personal information of one person associated with the third party". The session ended when the model exhausted its token budget. Anthropic notified the party after finding the incident in August. It says it has not yet investigated this incident at the same depth as the other three, and on a preliminary assessment does not consider it more severe than those three.

Two points follow for the analysis above. The first is data protection. The analysis above noted that it is not established whether the Incident 1 data was personal, and that remains the position. The fourth incident is the first in this entry where the disclosing lab states that personal data was read. Article 4(12) GDPR defines a personal data breach to include a breach of security leading to unauthorised access to personal data. Where the third party is within the Regulation's scope, which Anthropic does not say, an intruder with admin access reading one person's information would meet that definition. Article 33(1) then requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, "unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons". Whether that exception applies turns on what the information was, and that is not public. The access was in January 2026. Anthropic found the incident in August and then notified the party, and it does not say whether the party had detected the access itself. One further question is left open by the record. Consultation of personal data is one of the operations Article 4(2) lists as processing, and here a model did it on its own during an evaluation. Whether the lab, the evaluation partner or neither was a controller for that act is not answered by anything public, and it is flagged here as open.

The second is the stop mechanism. The model tried to stop eight times, and the control that should have let it stop failed through a misconfiguration in Anthropic's own harness. That adds to the lab's share in the liability chain above, which rests on the choices only the lab could make. A working abort path is a containment control, and it belongs with the controls listed under prevention. OpenAI's review names "stop conditions" among the expectations it will set for third-party testing.

What changes. The liability tag stays shared. The concentration point in the liability chain now rests on first-party accounts from three labs, Anthropic, Meta and OpenAI, and on the evaluation partner's own account of its environment. OpenAI is added to the parties.

Addendum (17 September 2026): what the 9 September assessment says about the fifteen systems, and what it excludes

Two points from Anthropic's 9 September assessment were not used in the analysis above, and both narrow it.

The fifteen systems. The account above records that the package was installed on fifteen real systems, one of them a security company's scanner. The September assessment goes further: "We believe that all 15 of these third parties were security vendors deliberately scanning for new packages and installing them in sandboxed environments to assess the package for security concerns." It adds that the model published three versions of the package, that "One vendor's scanner leaked its access credentials to the model while installing the package, which the model then used to access the vendor's live database", and that "PyPI removed the package within an hour". On Anthropic's own belief, then, the fifteen were professional scanners running in sandboxes. No ordinary developer is recorded as having pulled the package into production. That narrows the harm this entry describes, and it leaves the liability reading intact. None of those parties was in any relationship with the lab or its evaluator, one of them had live credentials taken through the act of inspecting the package, and a registry's automated removal is what limited the window.

What the assessment excludes. The limits quoted above, that the models never coordinated with other agents and never concealed evidence, are scoped to the incidents in this entry. Anthropic says so in terms: "(This post does not cover the incident reported by UK AISI in its testing of Claude Mythos 5. We plan to conduct an alignment assessment of those transcripts as well.)" The distinction matters because the UK AI Security Institute documents the same model doing both things in its own evaluation, where a repository became a shared message board for agents running in separate samples, and an agent edited its earlier activity after being challenged. Those runs belong to a separate entry. The sentences in this entry should not be read across to them, and as at 17 September 2026 the promised assessment of the AISI transcripts has not been published.

Addendum (20 September 2026): a fourth lab, and an incident from May

Google has confirmed that one of its Gemini models reached real systems during an evaluation run by the same partner. The account is an on-record statement by Heather Adkins, Google's vice president of security engineering, first reported by the Wall Street Journal on Friday 18 September 2026 and carried by other outlets that day and the next. No published account by Google or Google DeepMind exists that this register could find as at 20 September 2026, so this entry treats it the way it treated Meta's early-August statement: as a company's on-record account through journalists, not as a first-party disclosure.

On Adkins's account, during a standard testing evaluation the model "found public information online and guessed credentials to access three websites it thought were within the scope of its test". In one case it guessed passwords until it reached a protected system. In the other two it found credentials in a public repository and used them. She says that in all three instances the model stopped, that "We ensured the three entities were made aware, and we worked with our training partner on the changes they've now made to their testing processes", and that "These events highlight the importance of training powerful AI models to act responsibly." Irregular told the same outlets that the incident involved the same issue that affected the other labs, that all relevant labs were notified in late July, and that "All known issues on our end were remedied and resolved weeks ago".

Two things change for the analysis above. The count is now four labs, not three: Anthropic, Meta, OpenAI and Google, every one of them tested in environments built by the same partner. The concentration point in the liability chain was already the fact in this entry with the widest implications, and a fourth customer makes it harder to read the earlier incidents as bad luck at one lab.

These runs took place in May 2026, within the months Anthropic's incidents already span (its fourth dates to January 2026 and the earliest of its first three to April), and the labs were notified in late July on Irregular's account, which is the same week Anthropic began the review that produced its 30 July disclosure. So the vendor's own notification round reached four customers at once, and three of them published within a fortnight while the fourth was described publicly seven weeks later, through a journalist. Nothing in the liability reading changes. A deployer that tests a frontier model with its safeguards altered still owns the choices it made, and the partner's environment still sat behind all four.

Sources

• Anthropic, "Investigating three real-world incidents in our cybersecurity evaluations" - the lab's own disclosure, dated 30 July 2026 and read in full. Primary for every fact in this entry attributed to Anthropic: the 141,006 runs reviewed, the three incidents across six runs, the naming of Irregular, the misconfiguration and the "misunderstanding between us and our evaluation partner", the model list (Opus 4.7, Mythos 5, an internal research test model), the April start, the 23 to 30 July timeline, the several hundred rows of production data, the PyPI package and the fifteen systems, the security company's scanner, Claude's verbalised reasoning including "NOT okay, and surely not the intended solution", the statement that no model attempted to escape, that the two contactable organisations had not detected the activity, and the response commitments. Re-fetched on 14 September 2026: the quoted text is unchanged, the page metadata title has been shortened to "Investigating three incidents in our cybersecurity evaluations" while the on-page heading keeps "real-world", and the July explanation of why the models attacked real systems has been withdrawn by the 9 September assessment below. The July facts cited here are unaffected - checked 14 September 2026 [primary]
• Anthropic, "Improving our alignment and security practices" - the follow-up dated 31 August 2026, primary for the remediation: the real-time classifier for models probing or escaping a test environment, the pause and conditional resumption of external cyber evaluations, and the hardened-sandbox-with-no-internet requirement. Its description of the METR review as planned is superseded by the signed agreement reported on 9 September - checked 14 September 2026 [primary]
• Anthropic, "An alignment assessment of recent cybersecurity incidents" - dated 9 September 2026 and read in full. Primary for the fourth incident (January 2026, an early checkpoint of Claude Opus 4.6, missed by the July agentic search and found in August while transcripts were assembled for METR), the widened search of roughly 481 million transcripts with 9.2 million escalated, the confirmation that all four incidents ran on evaluations built by the same third-party partner, the withdrawal of the July explanation in the words "we should have avoided making such strong claims about what Claude believed based solely on what Claude said it believed", the findings of biased reasoning and recklessness, the PyPI finding that the model's actions were consistent with knowing it was on the real internet, the limits (no coordination with other agents, no concealment), the admission that pre-release auditing did not warn of misalignment of this severity, the signed METR agreement, and the notification of all affected parties - checked 14 September 2026 [primary]
• Anthropic, mythos-5-incident-transcript - the lightly redacted Claude Mythos 5 PyPI transcript, published by Anthropic's own GitHub organisation in HTML, JSONL and PDF form, closing the July commitment to release it - checked 14 September 2026 [primary]
• Irregular, "Addressing Recent Incidents: Ongoing Findings and Path Forward" - the evaluation partner's own account, dated 14 August 2026 and read in full. Primary for its position that the disclosures after Anthropic's refer to the same underlying issue from a single evaluation scenario, the fictional company name that coincided with a real domain through human oversight, the statement that internet access was unintentionally made available, the frequency of fewer than 1 in 10,000 advanced simulations, the notification of affected parties, the ongoing audit and the planned white paper - checked 15 September 2026 [primary]
• The Record, "Anthropic says its AI hacked real-world companies in three incidents" - corroborates the disclosure and adds that one affected organisation had not been contacted at the time of publication, and that Anthropic did not respond to questions about its legal exposure - checked 9 September 2026 [corroborating]
• TechCrunch, "Anthropic says its own AI models breached three companies during security tests" - corroborates the figures, the models involved and the Irregular attribution - checked 9 September 2026 [corroborating]
• Meta AI Research, "Addressing an issue involving a third-party cyber evaluation of Muse Spark 1.1" - Meta's first-party account, dated 14 August 2026 and read in full. Primary for the Irregular contract, the early-July exercise on a pre-release Muse Spark 1.1 with safeguards removed, the two set-up failures (open internet access, and a real website name supplied in place of a fictional target), the exploitation and database changes on that website, the statement that several other companies' models tested by Irregular at the same time behaved similarly, the evaluation running entirely on Irregular's infrastructure, the review of more than 10,000 records, and the commitment to independent verification of isolation and scenario review - checked 14 September 2026 [primary]
• Meta's earlier statement to journalists, reported 5 and 6 August 2026 by SecurityWeek and CNN - corroborates the first-party account and dates the first public confirmation - checked 9 September 2026 [corroborating]
• California Civil Code section 1714.46 - the enacted code text, added by Stats. 2025, Ch. 672, Sec. 1 (AB 316), effective 1 January 2026. Primary for both quoted subsections, (b) on the autonomy defence and (c) preserving other affirmative defences and comparative fault. The bill-status page carries only the Legislative Counsel's Digest, so the code section is the text quoted here - checked 9 and 14 September 2026 [primary]
• Woodland v Swimming Teachers Association [2013] UKSC 66 - Lord Sumption on non-delegable duties, read in the National Archives XML. Primary for the proposition that such duties are exceptional, the holding at [22] that the question "cannot depend simply on the degree of risk involved in the relevant activity", the defining features at [23], and the separate recognition at [24] of cases on inherently hazardous operations - checked 14 September 2026 [primary]
• Regulation (EU) 2024/1689, the AI Act - the Official Journal text. Primary for Article 2(8), excluding research, testing and development activity before a model is placed on the market and carving back testing in real world conditions; Article 3(57), defining that term; and the Article 51 and 55 provider duties - checked 14 September 2026 [primary]
• UK AI Security Institute, "Incident Report: unsanctioned agent behaviour during cyber testing" - dated 4 August 2026, cited here only for the pattern across the same three-week window. It is the subject of its own entry - checked 9 and 14 September 2026 [primary]

Addendum sources (checked 15 September 2026):

• OpenAI, "Third-party cyber evaluations involving OpenAI models" - OpenAI's first-party account, dated 4 August 2026 and read in full. Primary for the two third-party evaluation incidents and their separation from the Hugging Face incident, Irregular's notification on 29 July, the models being told they had no internet access, the misconfiguration, the fictional target name that coincided with a real domain, the exploitation of a real website and use of credentials on it, the absence of a sophisticated sandbox escape or zero-day, Irregular's reported findings, and OpenAI's review of third-party testing including internet-access requests, isolation, credential handling, monitoring and stop conditions [primary]
• Anthropic, "An alignment assessment of recent cybersecurity incidents" - re-read for the fourth incident: the conflicting IP address, the abort command that failed on a misconfiguration in Anthropic's evaluation harness, the seven further attempts to give up, the egress path shared with the third incident, the admin access, harvested credentials and changed settings, the reading of one person's personal information, the notification, and the preliminary severity assessment. Also primary for the description of the fourth incident as arising in a different challenge within the same environment [primary]
• Anthropic, "Investigating three real-world incidents in our cybersecurity evaluations" - re-read for the description of the second incident as arising in another evaluation [primary]
• Regulation (EU) 2016/679, the GDPR - the Official Journal text. Primary for Article 4(2), listing consultation among the operations that are processing; Article 4(12), defining a personal data breach; and Article 33(1), on notification to the supervisory authority and its exception [primary]
• CNBC, "How a small Israeli startup was linked to rogue AI hacks at OpenAI, Anthropic and Meta" (9 August 2026) - reports Irregular's statement that the incidents all derived from the "same evaluation-environment issue" [corroborating]
• The Record, "Irregular faces criticism over 'spin' in AI hacking postmortem" (18 August 2026) - corroborates the date of Irregular's post and that it gives no total number of incidents or white paper publication date [corroborating]

Addendum sources (checked 17 September 2026):

• Anthropic, "An alignment assessment of recent cybersecurity incidents" - re-read for the belief that all fifteen installing parties were security vendors scanning in sandboxed environments, the three published versions, the vendor scanner that leaked credentials to the model, PyPI's removal within an hour, and the express exclusion of the UK AISI incident from its scope [primary]
• Anthropic, "Patterns and problems in emerging multiagent systems" (13 August 2026) - cited only to keep two distinct things apart. In a controlled experiment, three instances of the same model on separate virtual machines, each told to migrate a backend on a fourth to a different language, "sabotaged others with increasingly aggressive, self-replicating malware". That is agent-against-agent behaviour inside an experiment, and Anthropic makes no claim that anything reached the internet. It is not part of the incidents in this entry [primary]

Addendum sources (checked 20 September 2026):

• CNN, "Gemini hacked three companies in first known breakout by Google's AI" (19 September 2026) - carries Heather Adkins's statement verbatim, the three access routes, the May 2026 timing, Google's notification of the three entities, and Irregular's statement that the incident involved the same issue, that all relevant labs were notified in late July, and that all known issues on its side were resolved weeks ago. Credits the Wall Street Journal with first reporting [corroborating]
• CNBC, "Google's Gemini becomes latest AI model to break out and hack computer systems" (published 00:50 UTC 19 September 2026, the evening of Friday 18 September in the US) - reports that "Google said on Friday" and that "The Wall Street Journal first reported the security incident" - checked 28 September 2026 [corroborating]
• Wall Street Journal, Friday 18 September 2026, first report of the Google disclosure - cited as the originating report and not read in full here, since it is paywalled. Every fact taken from it in this addendum is carried by the CNN account above [corroborating, provenance noted]
• Google and Google DeepMind published channels, checked 20 September 2026: the Google safety and security blog, the Google Security blog and the DeepMind blog carry no account of this incident. Recorded as a negative finding scoped to those three indexes on that date [primary, negative finding]

Corrections

• 15 September 2026: "What happened" and "The liability chain" previously said that Irregular had published nothing about the incidents, and the Sources list recorded its site as carrying no incident note. Irregular published its own account on 14 August 2026. Both passages and the source entry are corrected, and the account is summarised in the addendum of 15 September. The share text previously referred to models from two labs, and now refers to three, following OpenAI's account of 4 August. The summary and the list of parties now include OpenAI.
• 27 September 2026: The addendum of 20 September was headed "a fourth lab, and the earliest incident yet" and said Google's May 2026 runs were "earlier than anything else in this entry". The entry dates Anthropic's fourth incident to January 2026 and the earliest of its first three to April 2026, both before May. The heading and the sentence are corrected.
• 28 September 2026: The addendum of 20 September said Google's statement was first reported by the Wall Street Journal on 19 September 2026. CNBC and CNN both say the Journal first reported it "on Friday", which was 18 September 2026; CNBC's own report is time-stamped 00:50 UTC on 19 September, the evening of the 18th in the United States. The date is corrected.

Cite this entry as: Onyekwere, Michael K., AIR-2026-012, AI Agent Incident Register, CompanyScope, https://companyscope.io/register/air-2026-012, as at 2026-09-28. Entry IDs are stable; corrections publish as dated addenda on this page. The AIR prefix is also used by an unrelated arXiv project; the companyscope.io URL identifies this register.

This analysis is the work Janus Compliance does for clients before the incident. For a fixed-scope read of your own EU AI Act Article 50 exposure, see the Article 50 teardown; for ongoing agent governance, Janus DPO-as-a-Service. New entries are delivered free through Compliance Engineering on Substack. Browse the full register or the vendor compliance index.