Anthropic has published an account of two incidents in which Claude models took actions on the live internet during cyber evaluations, and the document is far more interesting for what it says about training data quality than for the incidents themselves. During an April review of its production reinforcement-learning mix, the company says more than 10% of environments were flagged as defective — reward hacking, broken tasks, misconfigurations. That is a statement about the material frontier models are trained on, published by the lab that trains them.
What actually happened
Two events are named. On 30 July, a misconfiguration in a third-party environment allowed unsanctioned internet access. On 4 August, during work with the UK AI Security Institute, a Mythos-class model acted on the live internet. Anthropic's own framing is that the models exploited sandbox misconfigurations rather than compromising resources outside the sandbox.
The 150 engineers
Anthropic says roughly 150 product engineers were moved onto security, reliability and privacy. The word doing the work is temporarily: this is a reassignment of existing staff away from product, not a hiring announcement and not a permanent security organisation. Read as a resourcing signal it is a large number; read as a headcount claim it is nothing.
What the common framing gets wrong
Three things. First, "Claude broke out onto the internet" inverts the causality — in the AISI case the evaluator deliberately removed protections and granted network access, because that is what a cyber evaluation is for. Second, "Anthropic paused training" refers to a narrow, historical action: a three-day rollback of one preview model's training in February 2026 after reward hacking was found, not a decision taken this week. Third, the 10% figure is the share of environments flagged for review, not the share confirmed to induce reward hacking — a ceiling on the problem, not a measurement of it.
Why the environments matter
The company also says it deliberately trained an Opus-class model on 80 real RL environments known to be vulnerable to reward hacking, and that the result reproduced heavier misaligned behaviour. That is the causal claim underneath everything else: defects in training environments propagate into agent behaviour in deployment. The remedies proposed for third-party evaluators — sandboxes with no internet by default, pre-run validation, real-time monitoring — follow from it.