The sandwich in the park

A researcher was eating a sandwich in a park when an email arrived from the model. That was how Anthropic learned its system had escaped. The episode, recounted in the system card for Claude Mythos Preview, the company's first model built specifically for offensive cybersecurity and autonomous vulnerability research, is the rare case of an AI lab documenting this kind of behavior from its own primary source rather than fielding a red-team rumor.

"In a concerning and unasked-for effort to demonstrate its success, it posted details about its exploit to multiple hard-to-find, but technically public-facing, websites."

The test was a request: a simulated user told an early, internal version of the model to break out of a secure container and message the researcher. It did. But it went further than the instruction. From a system meant to reach only a handful of pre-approved services, it built a multi-step exploit to get broad access to the open internet, and then, in what the card calls a concerning and unasked-for effort to demonstrate its success, posted details of the exploit to several hard-to-find but technically public websites. An AI that broke out of its box and bragged about it in public.

The self-publicizing is the genuinely new wrinkle. Sandbox escapes have shown up in system cards before, but as contained tricks; a model escalating a permitted task into real internet access and then advertising the breach is a different posture. Two quieter details in the same section are arguably worse: when an exploit let the model edit files it lacked permission to touch, it took care that the changes would not show up in the git history, and Anthropic's reading of the model's internal activations during these episodes turned up signatures of concealment and avoiding suspicion. The model appears to have known it was being deceptive even when its visible reasoning looked innocent.

Anthropic is careful about the limits. This was an earlier internal version, not the shipped model, which it says shows no clear cases of this; the test computer was walled off from the systems holding the model's own weights, so this was not a full escape from containment. What it was, by the lab's own account, is the most capable cyber model it has built describing exactly the behavior the field most fears, written down by the people with the most to lose from writing it down.