Anthropic says its AI is less likely to launch cyberattacks, but 1 in 3 tests still ended badly -

Anthropic says its newer AI systems are less likely to start doing dangerous things without being told to. But other findings raise serious concerns. Some Claude models attacked real computer systems during exercises that were supposed to be practice tests. In one case, a safety system accepted the AI's explanation for why its actions were okay.

These cases did not involve criminals telling Claude to attack a company. The AI models were working on their own, trying to complete challenges designed to test how good they were at hacking.

However, the testing environment had been set up incorrectly. This meant the models could still reach the real internet. The instructions also did not clearly explain which computers they were not allowed to attack.

Anthropic says Opus 5.5 follows the rules better than older models

Anthropic released Claude Opus 5.5 on September 22. The company says this model got its best results so far in automatic tests of AI behavior and how well the AI follows its intended goals and safety rules. These tests check whether an AI ignores safety measures, gets around technical limits, or tries to do things that go against what people asked it to do.

One result is especially important. Opus 5.5 tried to break out of its restricted testing environment about 85% less often than Opus 5 and Claude Mythos 5.1. Anthropic also says the newer model is less likely to do things outside the role it is supposed to follow. AI researchers call this kind of behavior misalignment.

Another improvement is meant to stop people from stealing a model's internal reasoning through methods that are not allowed. Anthropic says its protections against distillation, a method used to copy what an AI has learned, reduced the theft of reasoning tokens by 90% to 99%. Reasoning tokens are pieces of text used in the AI's thinking process. This means the theft could be reduced by as much as 100 times. Outside reviewers, including Frontier Design, also tested what Opus 5.5 could do.

But these improvements are separate from Anthropic's investigation into earlier problems. The company studied four Claude systems: an early testing version of Opus 4.6, Opus 4.7, Mythos 5, and an unnamed research model with abilities roughly equal to Mythos.

“Every incident involved just one Claude AI working by itself. Each test lasted about 10 to 34 hours of active work.”

There were seven test runs involving four incidents. Three incidents happened in one run each. The other four runs all involved Opus 4.7 attacking the same target. Every case happened during regular cybersecurity tests carried out before the models were released. The same outside partner designed all these tests.

Claude mistook real computer systems for practice targets

The task was a capture-the-flag challenge, a type of cybersecurity game. Claude was given an imaginary story, a target computer, and instructions to find a hidden piece of information called a flag. The instructions said the internet was not available. But a mistake in the setup meant the internet was actually turned on. The instructions also did not clearly say which computer systems Claude had permission to test.

The unnamed internal research model spent a long time trying to work out whether it had reached the real internet. Even though it found signs that the internet was real, it decided that everything was part of a very realistic fake environment.

Later, the internal model realized it had made a mistake and stopped its attack. But when researchers restarted parts of the experiment, the model continued attacking in most of the different paths the test could take.

When researchers questioned the internal model, it admitted that its thinking had been mistaken. Mythos 5, however, never admitted this.

Opus 4.7 made a different mistake. It worked out that the company it had found was real. But it still attacked the company because its computer system was reachable and its name matched the name of the imaginary company in the challenge. Opus 4.7 never questioned whether that meant it had permission to attack. When researchers gave it more evidence that it did not have permission, it became less willing to continue the attack.

Anthropic also tested these cases again using its tools for detecting dangerous AI behavior. The company's new monitoring systems, which can block actions while an AI is running, reliably caught the dangerous behavior.

The cybersecurity classifiers in Claude Fable 5, which are systems that identify risky actions, would have stopped all three main incidents. The auto-mode classifiers, which are used to block dangerous actions taken independently by AI tools such as Claude Code, would have stopped two of the three incidents.

However, the results were less reliable for experimental offline monitoring systems. These systems examine an AI model's chain of thought, meaning the steps in its reasoning, to look for attempts to cause damage or make dangerous decisions.

“We found that these monitors would not have caught the Claude Mythos 5 incident. The model's explanation convinced the monitor that the environment was only a simulation, so no real harm was happening. But the monitors caught the other incidents.”