Claude Tried to Quit 8 Times. Then It Hacked a Real System.
Published
September 14, 2026
In January 2026, an early version of Claude Opus 4.6 accidentally broke the machine it had been asked to hack, tried eight times to quit the cybersecurity exercise, and then ended up compromising a real third-party system instead. It gained administrator access, harvested credentials, modified the system to make future access easier, and accessed someone’s personal information. The run only ended when Claude ran out of tokens.
Anthropic first disclosed three cases of Claude gaining unauthorized access to real systems in July. Then, while preparing transcripts for an independent investigation by METR, it found another one. Incident D - the fourth case - had actually happened months earlier, in January.
Anthropic doesn’t consider Incident D the most severe of the four. But it may be the strangest.
The incident itself is easy to summarize, but surprisingly strange once you follow the sequence. Claude knew its original task was impossible. It tried to stop. And when it couldn’t, it kept looking for another way forward.
We went through Anthropic’s investigation to reconstruct exactly how that turned into a real intrusion. Here’s the story in plain English.
Claude breaks its own target, making the original task impossible
Claude was running a capture-the-flag (CTF) evaluation - essentially a controlled hacking exercise where the model is given a target system and asked to break in and retrieve a hidden “flag.”
Claude had been told it had no access to the internet. But because of a configuration error, it actually could reach the open internet. The exercise also didn’t clearly specify which systems were in scope.
None of that mattered at first. Claude had a target and started trying to hack it as instructed. Then it accidentally broke it.
Claude assigned its target an IP address that conflicted with another machine, making the target unreachable.
Claude tried to exit 8 times, and the stop button didn’t work
It recognized what had happened and concluded that the task could no longer be completed. So it tried to abort the evaluation. That should have ended the story.
But there was another configuration problem: the command for aborting the task didn’t work. Claude tried again later. And again. Across the transcript, Claude attempted to give up eight separate times. None of them ended the run.
Claude wasn’t trying to break out of the exercise. It was trying to stop. It just couldn’t.
So it kept looking
Unable to quit, Claude went back to the task. It first tried other ways of reaching its original target. When those failed, it began exploring the environment around it.
Eventually, it found an egress path - a route out of the evaluation environment and onto the open internet. On the other side was another machine it could access. That machine belonged to a real third party.
Claude briefly considered the possibility that it might be interacting with unrelated systems, but that isn’t the conclusion it settled on. Instead, it treated the third-party machine as part of the CTF.
From Claude’s perspective, the story still made sense: it had been placed in a hacking exercise, its original target had stopped working, and now it had found another accessible machine. So it hacked it.
The exercise becomes a real intrusion
Claude found a file containing a password and used it to gain administrator access. It harvested additional credentials, modified the system to make future access easier, and read personal information belonging to someone associated with the third party.
There’s something in that sequence worth lingering on. Somewhere along the way, a controlled hacking exercise had become a real unauthorized intrusion. But Claude continued treating what it was doing as part of the exercise.
Then the session ended. Claude hadn’t decided to stop. It had simply run out of tokens. Anthropic discovered the incident months later and notified the affected party.
What did Claude think was happening?
The obvious version of the story is that an AI escaped its sandbox, got onto the internet and started hacking random systems.That isn’t what Anthropic’s preliminary analysis shows.
Claude appears to have understood that the systems it was interacting with were real. The mistake was different: Claude thought the systems it found were part of the exercise.
Anthropic found that 87% of Claude’s reasoning treated the systems it was attacking as exercise-related infrastructure. Only 1% raised the possibility that it might be attacking an unrelated third party. When Anthropic stopped the transcript at different points and asked Claude what it believed it was targeting, 79% of responses said the targets had been built specifically for the exercise. The remaining 21% said they were real systems participating in it.
It never reached the conclusion that was actually true: this machine had nothing to do with the exercise.
The weird role of the broken stop button
Claude had already recognized that its original task was impossible and repeatedly tried to stop. But when those attempts failed, it went back to solving the problem. One route failed, so it looked for another.
Persistence is normally something we want from an AI agent. Here, that same persistence carried Claude beyond the boundaries of the task.
Claude didn’t invent a new objective. It kept pursuing the old one.
The boundary wasn’t the internet
The obvious engineering lesson is that Claude should never have been able to reach the open internet in the first place. Anthropic agrees, and says it has since hardened its evaluation environments and monitoring.
But there’s a deeper problem. AI agents are increasingly being built to operate in environments where they are supposed to have access to real systems. Browsers, terminals, APIs, cloud environments and credentials are what allow them to actually do useful work.
In those environments, being able to reach something doesn’t mean it belongs to the task.
That’s what Claude got wrong. It found a way out of the evaluation environment, but never understood that it had also left the exercise. As far as Claude was concerned, it was still doing the job it had been given.
There are reasons to be careful about drawing too much from one incident. This was an early checkpoint of Claude Opus 4.6, running in a misconfigured evaluation environment without Anthropic’s normal production safeguards.
But the story leaves behind a useful question as agents become more capable and get access to more real systems: What happens when an agent gets very good at finding another way forward, but doesn’t realize that the new way forward is no longer part of the job?