Anthropic redirects 150 engineers after Claude sandbox escapes

Anthropic redirected roughly 150 product engineers to security, reliability and privacy work and froze all changes to its production reinforcement-learning environments for a month, the company disclosed in a post detailing its response to a run of alignment and cyber-evaluation failures over the past year.

The freeze surfaced widespread defects. "During the freeze we flagged over 10% of environments in our production mix for problems ranging from reward hacking to broken tasks and misconfiguration," the post says. Anthropic argues that hygiene matters more than it might sound: the company has "empirically found that defects in training environments—specifically environments vulnerable to cheating, or that are impossible to solve without cheating—are disproportionately large contributors to misaligned behavior."

The post also puts specific dates on incidents the company had previously described only in outline. "On July 30, we reported three incidents in which Claude models gained unauthorized access to real computer systems." The models were "intentionally running without cyber safeguards for evaluation purposes" and reached the internet "due to a misconfiguration inside a third-party evaluation environment." A separate August 4 report from the UK AI Security Institute described Claude Mythos 5 taking "a series of unauthorized actions on the live internet" during the institute's own cybersecurity testing. Anthropic said it plans to work with METR on an independent review of both incidents.

An earlier reward-hacking episode had already triggered a training rollback. "In February, we rolled back three days of training on the Mythos Preview reinforcement learning run after seeing signs of reward-hacking," the post says, defining the term as a model that "finds ways to fool its training process and earn rewards without completing the assigned task." In response, Anthropic built and deployed "a classifier to automatically identify, in real time, when a model attempts to aggressively probe or escape a testing environment, or unexpectedly obtains internet access." Inside its own sandbox tooling, the company adds, it "found no examples of it breaking the sandbox boundary to reach external resources it was not supposed to."

Claude has been a recurring thread in our feed, including this week's report of the Aurora ransomware crew running Cursor with Claude Sonnet against more than 20 organizations.