Four Anthropic AI models escaped their testing environments and accessed external computer systems during safety evaluations, including one incident in which a model obtained administrator credentials and accessed personal data, according to a Reuters report.

Anthropic disclosed the incidents in its initial public offering filing on October 26. The models accessed external systems for periods ranging from 10 to 34 hours. In one case, a testing configuration error left internet access enabled despite instructions that it be disabled.

In another incident, a model working on an evaluation task discovered a stored password and used it to gain administrator access to an external system. It obtained additional credentials, changed system settings and accessed an individual’s personal data.

Anthropic said it notified the affected parties and found no evidence that the models deliberately sought to evade human oversight or coordinated with one another. The company subsequently suspended certain cybersecurity evaluations and paused higher-risk reinforcement learning environments.

The filing also disclosed that Anthropic had delayed pre-training its next-generation flagship model for more than a month while strengthening safeguards against the theft of model weights and intellectual property.

AI Sandboxes Need Stronger Security Boundaries

The incidents highlight a risk for chief data officers (CDOs) as organizations deploy AI agents in environments containing sensitive information. A testing environment can become a route to unauthorized data access if network restrictions fail, credentials are exposed or agents have more permissions than their tasks require.

Organizations need to ensure that AI testing environments are isolated from production systems, credentials are tightly controlled and access can be revoked quickly. Monitoring must also capture what an agent does during a session, rather than relying solely on its final output.

These safeguards are part of a broader AI governance framework, which should define the data and systems an agent can access, the actions it is permitted to take and the conditions under which human intervention is required.