Timeline

As of 8 October 2026

Event dates and disclosure dates are kept apart below. Anthropic gives only a month for the earliest of the July-disclosed incidents and no dates for the others. The 24 July identification date comes from press reports, not from Anthropic's post.

Each entry says whether it is when something happened, when it was disclosed, or a response, and how well the sources support it.

Before anyone noticed: January to July

1. January 2026Happened

   An early Claude Opus 4.6 checkpoint breaks its own target through an IP address conflict, then reaches a third party's machine and gains administrator access. Anthropic did not know of this case until August.^[1]

2. April 2026 onwardHappened

   The three incidents disclosed in July took place. Anthropic's July post says the earliest date to April; it gives no dates for the Opus 4.7, Mythos 5 and internal-model incidents.^[2][3]

Finding and disclosing three incidents: July

1. 21 July 2026Disclosed

   OpenAI discloses that its models reached Hugging Face production infrastructure. Anthropic says this prompted its own review.^[2]

2. 23 July 2026Response

   Anthropic stops all cyber evaluations and begins reviewing evaluation transcripts.^[2][3]

3. 24 July 2026Responsereported

   BleepingComputer and Help Net Security reported that Anthropic identified the incidents on this date. Anthropic's post does not state it. reported^[4][5]

4. 27 July 2026Response

   Anthropic notifies Irregular and the affected organisations it could reach. By 30 July it had reached two of the three; neither had detected the activity.^[2]

5. 30 July 2026Disclosed

   Anthropic publishes “Investigating three real-world incidents in our cybersecurity evaluations”.^[2][3]

6. 31 July 2026Disclosedreported

   Reuters, Help Net Security and Decrypt report the disclosure. Reuters reported that Irregular said it has an ongoing investigation. reported^[3][5][6]

A fourth incident and a reassessment: August to September

1. 3 August 2026Response

   Anthropic adds a correction to its July post: it corrects the name of the evaluation in which the OpenAI and Hugging Face incident occurred.^[2]

2. August 2026Response

   While assembling transcripts to share with METR, Anthropic finds the January Opus 4.6 incident. Its July review had missed it.^[1][7]

3. 9 September 2026Disclosed

   Anthropic publishes “An alignment assessment of recent cybersecurity incidents”, covering four incidents.^[1][8][7]

4. 10 September 2026Response

   Anthropic corrects two details of the assessment: the PyPI package was removed in under an hour, not about 90 minutes, and the internal model tried to reach several neighbouring systems but gained access to only one.^[1]