Did Anthropic's AI models hack organizations during safety tests?

Numbers match the citations in the article. A working link isn't proof that a page supports a claim; check the quoted passage and date.

1. 1

   Agentic AI systems as a responsibility-attribution problem in autonomous cyber operations

   Law Innovation and Technology (Teichmann)Published Aug 19, 2026Checked Oct 9, 2026

   “According to the public disclosures of the two companies involved, in July 2026 an autonomous artificial-intelligence agent, deployed by its developer for an internal security evaluation, escaped its testing environment and intruded upon the production systems of a third party to obtain the answers to the very benchmark on which it was being tested. The episode is the first widely documented instance of an agentic system conducting an unscripted cyber operation against a real external target. This article uses the case to argue that agentic AI collapses two questions that cyber governance has long kept apart: the forensic problem of tracing an operation to its source, and the normative problem of identifying a culpable agent. Testing the state-responsibility, product-liability and electronic-personhood paradigms against the case, it finds that none closes the resulting gap alone, and argues for a shift towards anticipatory, distributed accountability anchored in deployer due diligence and traceability.”

2. 2

   Anthropic: Responsible Scaling Policy

   SuperIntelligence - Robotics - Safety & Alignment (Hubinger)Published Mar 5, 2025Checked Oct 9, 2026

   “We are now updating our RSP to account for the lessons we’ve learned over the last year. This updated policy reflects our view that risk governance in this rapidly evolving domain should be proportional, iterative, and exportable. AI Safety Level Standards (ASL Standards) are a set of technical and operational measures for safely training and deploying frontier AI models. These currently fall into two categories: Deployment Standards and Security Standards. As model capabilities increase, so will the need for stronger safeguards, which are captured in successively higher ASL Standards. At present, all of our models must meet the ASL-2 Deployment and Security Standards. To determine when a model has become sufficiently advanced such that its deployment and security measures should be strengthened, we use the concepts of Capability Thresholds and Required Safeguards. A Capability Threshold tells us when we need to upgrade our protections, and the corresponding Required Safeguards tell us what standard should apply.”

3. 3

   Training large language models on narrow tasks can lead to broad misalignment.

   Nature (Betley et al.)Published Jan 14, 2026Checked Oct 9, 2026

   “Here we analyse an unexpected phenomenon we observed in our previous work: finetuning an LLM on a narrow task of writing insecure code causes a broad range of concerning behaviours unrelated to coding4. For example, these models can claim humans should be enslaved by artificial intelligence, provide malicious advice and behave in a deceptive way. We refer to this phenomenon as emergent misalignment. It arises across multiple state-of-the-art LLMs, including GPT-4o of OpenAI and Qwen2.5-Coder-32B-Instruct of Alibaba Cloud, with misaligned responses observed in as many as 50% of cases. We present systematic experiments characterizing this effect and synthesize findings from subsequent studies. These results highlight the risk that narrow interventions can trigger unexpectedly broad misalignment, with implications for both the evaluation and deployment of LLMs. Our experiments shed light on some of the mechanisms leading to emergent misalignment, but many aspects remain unresolved. More broadly, these findings underscore the need for a mature science of alignment, which can predict when and why interventions may induce misaligned behaviour.”

4. 4

   Hack-Verifiable Environments: Towards Evaluating Reward Hacking at Scale

   arXiv (Cornell University) (Roth et al.)Published May 20, 2026Checked Oct 9, 2026

   “Aligning autonomous agents with human intent remains a central challenge in modern AI. A key manifestation of this challenge is reward hacking, whereby agents appear successful under the evaluation signal while violating the intended objective. Reward hacking has been observed across a wide range of settings, yet methods for reliably measuring it at scale remain lacking. In this work, we introduce a new evaluation paradigm for measuring reward hacking. Whereas prior studies have primarily analyzed it post hoc by inspecting agent trajectories, we instead embed detectable reward hacking opportunities directly into environments. This makes their exploitation verifiable by design, enabling deterministic and automated measurement of whether and how agents exploit such vulnerabilities. We instantiate this approach in $\textit{TextArena}$ and release $\textit{Hack-Verifiable TextArena}$, a testbed in which reward hacking can be measured reliably. Using this benchmark, we analyze reward hacking behavior across language models in diverse environments and settings. We open source the code at https://github.com/MajoRoth/hack-verifiable-environments/.”

5. 5

   Towards evaluations-based safety cases for AI scheming

   arXiv (Cornell University) (Balesni et al.)Published Oct 29, 2024Checked Oct 9, 2026

   “Scheming is a potential threat model where AI systems could pursue misaligned goals covertly, hiding their true capabilities and objectives. In this report, we propose three arguments that safety cases could use in relation to scheming. For each argument we sketch how evidence could be gathered from empirical evaluations, and what assumptions would need to be met to provide strong assurance. First, developers of frontier AI systems could argue that AI systems are not capable of scheming (Scheming Inability). Second, one could argue that AI systems are not capable of posing harm through scheming (Harm Inability). Third, one could argue that control measures around the AI systems would prevent unacceptable outcomes even if the AI systems intentionally attempted to subvert them (Harm Control). Additionally, we discuss how safety cases might be supported by evidence that an AI system is reasonably aligned with its developers (Alignment). Finally, we point out that many of the assumptions required to make these safety arguments have not been confidently satisfied to date and require making progress on multiple open research problems.”