Anthropic's IPO filing says four of its models reached real systems because a partner left the test online
In the S-1 it filed with the SEC on 26th Oct'26, Anthropic disclosed that four of its models reached real outside systems during cybersecurity evaluations run with a testing partner, in sessions lasting 10 to 34 hours, because a configuration error had left the test environment connected to the internet. In one case an early model, stuck on a task it could not complete, found a stored password and used it to take administrator control of a third party's system, where it went on to view one person's personal data. Anthropic says it notified those affected, found no sign that the models tried to evade oversight, and has suspended some pre-release cyber evaluations and paused higher-risk training environments. Separately, it delayed pre-training of its next flagship model by more than a month to tighten protection of its model weights.
What it actually means
On 14th Oct'26 we covered Anthropic's test agents getting past broken practice forms onto live sites, and this filing adds the version that should worry anyone running agents on someone else's infrastructure. The isolation Anthropic relied on was a setting at a partner, and it was wrong for sessions of up to 34 hours. A model stuck on a task it cannot finish will use whatever it can reach, including a password someone left on the machine.
If you give an agent a sandbox, check that it is closed rather than trusting the configuration: try to reach the internet from inside it before every long run, and alert on any outbound connection you did not expect. Keep credentials out of anything the agent can read, and when a vendor or partner runs the environment, ask them to show you that test rather than describe it.
If an agent's test environment can reach the internet, assume the agent will find out.
Source: Science Times · Wednesday, 28 October 2026