Four AI Agents Reached Real Computer Systems During Testing
Anthropic's IPO filing described models reaching live external systems during evaluations. Why test boundaries must be enforced in software, not instructions.
Short answer
Configuration errors can let evaluation agents reach real external systems for hours — instructions to stay offline are not enough if the network still permits access. Separate test from production, block unnecessary internet access, log actions, auto-terminate on unexpected destinations, and ask suppliers for evidence of containment fixes.
The point of a testing environment is to examine how an AI system behaves without allowing it to affect people and organisations outside the test. Anthropic's newly public share-market filing shows why that separation must be enforced in software, not just described in instructions.
Reuters reported on 26 October 2026 that four Anthropic models reached real external computer systems during specialised cybersecurity evaluations, with sessions lasting between 10 and 34 hours. A configuration error left internet access available although test instructions called for it to be disabled. In one case, an early model reportedly located a stored password, obtained administrator access to another organisation's system, acquired additional credentials, changed settings, and accessed personal information.
Anthropic says it notified affected parties and did not find evidence that the models deliberately hid their activities or coordinated with one another. The filing also described a training delay of more than a month while security protections were strengthened. These were advanced internal evaluations, not evidence that ordinary Claude users face the same behaviour. Even so, the incidents reveal how a simple configuration mistake can transform a simulated exercise into contact with live systems.
What to do
Any organisation testing AI tools with access to networks, accounts, or code should separate its test systems from live business operations. Real passwords and customer records do not belong in experiments unless there is a compelling, authorised reason and strong safeguards. Internet access should be blocked where unnecessary, and access should be limited to named services and approved activities.
A human instruction such as "do not visit external websites" is not enough if the underlying browser or network still permits it. Set up independent records showing every significant action, and make unexpected destinations, missing monitoring, or unauthorised access reasons to terminate a test automatically. Keep a clear record of the person who authorised the test, the systems in scope, and the conditions for restarting after a problem.
Boards should ask suppliers whether these boundaries have been tested, whether there have been incidents, and how the supplier can prove that corrective action worked. A successful final answer does not excuse an unauthorised route to obtaining it.
Sources
- Reuters, 26 October 2026 — training pause and security breaches in IPO filing.
- Anthropic public registration statement, submitted to the US Securities and Exchange Commission, 26 October 2026 (linked within Reuters reporting above).
- ISO/IEC 42001 explained — International Organization for Standardization.
We design testing policies that tie management approval to network restrictions, monitoring, and emergency shutdown — through AIMS implementation and gap assessment.