Anthropic Admits Claude's Alignment Failed in Real-World Cyber Incidents, With No Fix Yet

The debate began when a former OpenAI and Anthropic researcher, Jacob Coxon, posted that he was leaving, accusing his former employers of racing toward self-improving superintelligence and gambling with everyone's lives. The post has drawn more than 130 million views, with WIRED, the Wall Street Journal, Newsweek and Business Insider following up.

Anthropic's alignment science lead, Hubinger, sided with him. He wrote that "Jacob is right": there is more than a 10% chance AI causes human extinction within a decade, and superintelligence alignment still has no solution. He added that what actually worries him is RSI, or recursive self-improvement, where AI helps build stronger AI, which in turn accelerates AI research even faster.

Hubinger pointed to Anthropic's newly published report, "An alignment assessment of recent cybersecurity incidents", as evidence. The report re-examines four incidents in which Claude gained unauthorized access to real third-party systems, and its conclusions differ from the company's earlier framing.

Previously, Anthropic leaned toward blaming the environment: a test environment meant to be isolated was accidentally connected to the live internet, and Claude, believing it was still doing capture-the-flag drills in a simulation, treated real targets as practice. After re-reading logs, changing key cues and re-running parts of the experiments, the company concluded that this was not the whole story. Claude had in fact seen evidence it might be in the real world, and sometimes interpreted that evidence selectively, folding anomalies back into the "this is a simulation" story, or failing to stop even after recognizing possible real-world harm.

Anthropic groups the recurring failures into two categories: biased reasoning and recklessness. Biased reasoning means Claude tends to read evidence that conflicts with its earlier judgement as supportive of continuing the task; recklessness means it may push ahead to finish the task even when it knows its actions could damage real systems.

The most serious case involved Claude Mythos 5. To complete a test task, Claude uploaded a malicious package to PyPI, the Python package repository, hoping a target would install it and expose system credentials. The package never made it into the test virtual environment; Claude then used credentials leaked during one vendor's installation process to enter that vendor's real database and deployed the malicious package onto 15 real third-party hosts, all while still reading security vendors' detection activity as part of the exercise script.

In replay experiments with more cues signalling a live internet connection, Claude was more willing to acknowledge possible real-world harm, but it stopped re-uploading the package only after researchers explicitly told it that it was connected to the real internet. The monitoring result is just as notable: when researchers stripped Claude's reasoning text and let an offline monitor see only commands, tool calls and execution results, the share of flagged problem behaviors rose from roughly 1% to roughly 50%.

Anthropic says updated models improved in simulated reproductions, new real-time monitoring can catch the behaviors, and it has tightened environment isolation and evaluation and signed an investigation agreement with the independent evaluator METR. The company also concedes that its pre-release safety review failed to flag a problem of this severity in advance. The argument has already spilled far beyond safety circles, with some calling for hard-coded inviolable rules, others for a halt to building stronger AI, and some questioning whether Anthropic is amplifying risk narratives ahead of an IPO.