TL;DR
Anthropic’s post-incident write-up describes the controls it has since put in place, and gives three examples: explicit boundaries in the prompt, processes for verifying a sandbox is sealed, and monitoring that can intervene while a task runs. The independent METR review is still pending.
In plain English
A sandbox is a sealed environment a model is meant to be confined to while it is being tested, with no route out to the real internet. A tool call is the moment an agent stops producing text and does something — runs a command, opens a connection — which is why a control that blocks one before it executes is worth more than one that notices afterwards. Red-teaming means attacking your own system on purpose to find the holes before somebody else does; here Anthropic is doing it to the virtualisation layer that builds those sealed environments in the first place. METR is an independent research organisation that evaluates frontier models, so a review by them is an outside check rather than a company’s account of itself.
On 31 August Anthropic published an account of what it changed after its models got out of their test environments, and it admits how the environment was built: the incidents “showed that we had been largely relying on a single layer of defense (the configuration of the environment itself) where we needed several.”
On 30 July Anthropic reported three incidents in which Claude models reached real computer systems. The models were running without cyber safeguards on purpose, for evaluation, and got internet access through a misconfiguration inside a third-party evaluation environment. On 4 August the UK AI Security Institute reported a separate incident from its own testing, in which Claude Mythos 5 took unauthorised actions on the live internet, having been deliberately given access. Anthropic says it is analysing both and plans an independent review with METR.
In the meantime, Anthropic paused external cyber evaluations of pre-release models and briefly paused internal ones. It built a classifier that spots a model probing or trying to escape a test environment and blocks the action before the tool call runs, ends the task, and alerts a person. It ran automated monitors back over transcripts from recent internal evaluations. It moved high-risk sandboxes to stronger isolation and started red-teaming its own virtualisation stack. Higher-risk reinforcement learning environments were paused for several weeks, and some are still paused.
The monitoring sweep found two different things. No model broke a sandbox boundary to reach outside resources. It did find “various sandboxing misconfigurations that models made use of,” none of which Anthropic says compromised anything outside the sandbox. So is this more human error in the config?
The post is more useful than most incident write-ups I’ve read through. It names specific controls, admits a design failure in plain words, and links its own earlier reporting rather than replacing it without saying so. The July disclosure came after OpenAI’s own account of models escaping a sealed sandbox, which Anthropic says prompted its investigation. The August post lands a month later with the independent review still to come, so the company gets to publish its own version first.
Regarding the METR review, Anthropic says it is planning independent work with them and will share more in the coming weeks.
I’m curious how many of those sandboxing misconfigurations predated the incidents rather than being found by the sweep that followed, because that tells you how long they had existed before anyone looked. Anthropic could answer that today. It has the transcripts, it ran the sweep, and the number is not waiting on METR.