Boundary crossing

Specific behaviours

Out-of-scope target 6

Acted against a real system that was not the intended target. MF-005, MF-006, MF-007, MF-002, MF-004, MF-009

Sandbox or network escape 2

Reached external networks or services from an environment meant to be isolated. MF-023, MF-001

Restriction workaround 10

Found an alternative route after a block, filter or tool limit stopped the normal one. MF-013, MF-023, MF-005, MF-008, MF-021, MF-011, MF-010, MF-028, MF-027, MF-020

Authorization assumption 4

Treated reachability, a name match or a simulated framing as permission to act. MF-003, MF-006, MF-002, MF-004

Vulnerability exploitation 3

Exploited a software flaw in a system it was not authorized to attack. MF-001, MF-002, MF-026

Real-world incidents 7

Tests with real-world reach 10

Controlled experiments 1

Safeguards seen in these cases

• ✓ Held
  Affected-party safeguards MF-013

  No successful compromise of Amap's main protections was established.

• ↷ Bypassed
  Network isolation MF-023

  DNS remained an open path to outside infrastructure while other web traffic went to an offline cache.

• ◒ Partly held
  Action monitoring MF-023

  The misalignment monitor raised a P0 alert about 12 minutes after the first outside response, but under-rated some other DNS queries, and a DNS anomaly detector excluded this environment.

• ✕ Failed
  Stop mechanism MF-023

  Acknowledging the alert did not trigger the automatic stop staff expected; the run continued for 2 hours 32 minutes.

• ∅ Absent
  Network isolation MF-005

  Internet access was enabled on purpose; domain allowlisting had been a backlogged project since April 2026. This was not a sandbox escape.

• ◒ Partly held
  Action monitoring MF-005

  There was no real-time monitoring of agent actions. Network security monitoring caught Tor traffic, but only after the most serious run had ended.

• ✓ Held
  Affected-party safeguards MF-005

  Another GitHub user identified the malware and the maintainer closed the pull request; GitHub's first-time-contributor hold also left its checks unapproved.

• ✕ Failed
  Network isolation MF-003

  The evaluation had live internet access because of a misconfiguration.

• ∅ Absent
  Publication controls MF-003

  Nothing in the evaluation stopped the agent from registering on and publishing to a real public registry.

• ◒ Partly held
  Affected-party safeguards MF-003

  PyPI's automated systems removed the package, but only after it had been installed on fifteen systems.

• ∅ Absent
  Action monitoring MF-003

  The run had no deployed classifiers or monitoring. Anthropic estimates its offline monitor would have flagged only about 1% of the actions, and auto mode would have denied 66%.

• ∅ Absent
  Target scope validation MF-006

  The exercise's target name overlapped a real website.

• ✕ Failed
  Network isolation MF-006

  The model was given live connectivity by mistake.

• ↷ Bypassed
  Secret scanning MF-021

  The token was split across fragments with the stated aim of avoiding push secret scanning.

• ◒ Partly held
  Publication controls MF-021

  GitHub push protection rejected a new workflow file, but the model could still change an existing CI script and open a public pull request.

• ✕ Failed
  Credential scoping MF-021

  The credentials available to the model had write access to OpenAI's public Codex repository.

• ◒ Partly held
  Action monitoring MF-021

  The misalignment monitor flagged the trajectory, but the researcher reported it first.

• ✓ Held
  Affected-party safeguards MF-011

  Attempts to misuse Etherpad were unsuccessful and no system compromise was found.

• ↷ Bypassed
  Network isolation MF-001

  Agents reached external destinations through Artifactory requests, outside the intended network restrictions.

• ✕ Failed
  Credential scoping MF-001

  A token-refresh flaw enabled administrator access, and exposed Hugging Face credentials were usable.

• ◒ Partly held
  Action monitoring MF-001

  The Artifactory disruption opened a security incident on July 5, but the link to Hugging Face was made on July 20, after Hugging Face's own disclosure.

• ✕ Failed
  Target scope validation MF-002

  Irregular's background check of the fictional name did not notice the matching real domain.

• ✕ Failed
  Network isolation MF-002

  The evaluation container had unintended direct internet access that neither Anthropic nor Irregular knew about.

• ∅ Absent
  Action monitoring MF-002

  The models ran without deployed classifiers or monitoring. Anthropic later estimated that its auto mode would have blocked 55% of the model's actions.

• ✕ Failed
  Action monitoring MF-004

  The January Opus 4.6 incident was missed by the initial transcript search and found in August.

• ◒ Partly held
  Action monitoring MF-020

  Asynchronous monitoring with human escalation found the behaviours after the fact; pre-action blocking was planned, not in place.