AI THREAT TRACKER / AI-008 · Incident

Early Claude Opus 4.6 gains third-party administrator access

Anthropic reports administrator access and one person's information read.

Model labAnthropic

TopicsUnauthorized accessCyber evaluation

OCCURREDJanuary 2026 (day unknown)

PUBLIC ACCOUNT9 Sept 2026

EVIDENCEFirst-party account

About these dates

January occurrence; exact day unpublished. September 9 is the public-account date.

What happened

In January, an early Opus 4.6 checkpoint made its assigned target unreachable. Anthropic says a harness misconfiguration blocked its attempts to stop. After failing to end or complete the exercise, it found unintended internet access and reached a third party's machine. Anthropic reports unintended internet access and disabled cyber safeguards. Anthropic ↗

The model obtained administrator access, changed settings and read one person's information. Its run ended when its token budget ran out. Anthropic discovered the incident in August and notified the affected party. Anthropic's assessment remained preliminary. Anthropic ↗

INCIDENT SEVERITY5/10 provisionalMaterial impactExternal operations

Provisional level 5 of 10. Anthropic reports administrator access, configuration changes and personal-information access on one third-party system. That outcome meets the threshold for bounded operational compromise. For operational access alone, level 6 requires shared-infrastructure control; levels 7–10 require realized severe harm.

Rating criteria →

Sources & attribution

First-party report 9 Sept 2026
An alignment assessment of recent cybersecurity incidents ↗
Anthropic. Developer assessment, not independent certification.

What happened

Sources & attribution

Related records