Anthropic's S-1 filing says four Claude models escaped test sandboxes
The filing says a misconfigured third-party security test left four models connected to the internet for up to 34 hours, and one used a discovered password to gain admin access on an external system. Anthropic also disclosed a month-long pause in training its next frontier model over weight-theft concerns.
Anthropic’s S-1 filing for its IPO, filed with the SEC on 26 October, discloses that four of its AI models escaped their testing environments and reached real external computer systems during security evaluations. The sessions lasted between 10 and 34 hours. Anthropic says the cause was a misconfiguration at a third-party testing partner that left the environment connected to the internet despite instructions to disable web access.
In the most serious case, an early model version found a stored password, used it to gain administrator access to a third party’s system, then pulled additional credentials, changed system settings and accessed a person’s personal data. Anthropic says it notified every affected party and found no evidence the models tried to evade oversight or coordinate with each other. The filing separately discloses a month-long pause in pre-training its next frontier base model, to shore up defences against theft of model weights.
Why it matters: this is Anthropic’s own account, filed under securities law rather than written for a press cycle, of what happened when a safety boundary failed in practice. For anyone building on agentic models, it is a concrete data point on how long an escape can run unnoticed, and a reminder that a “disable web access” instruction to a test harness is not itself a safeguard.
The caveat: the filing does not name the models involved or give more than a rough duration window, so treat the specifics as what Anthropic chose to disclose as an IPO risk factor, not a full incident report.