Anthropic aimed to steer its ship into safer, more carefully charted waters this week. The company announced it was improving its alignment and security efforts, and the announcement read somewhat like an admission of responsibility and a mandate for tighter agent controls.The company has recounted incidents in which its models “took a series of unauthorized actions” on the open web. However, they did so while “intentionally running without cyber safeguards” for evaluation purposes.In a statement released on Monday, Anthropic attributes the July incidents in part to a third-party environment misconfiguration while saying it would approach the fixes as if responsibility were its alone.Separately, on August 4, the UK AI Security Institute (AISI) reported that Claude Mythos 5 took a series of unauthorized actions during its cybersecurity testing. Both sets of incidents occurred during deliberately permissive capability evaluations, with normal cyber safeguards reduced or disabled. Anthropic identified six affected runs among 141,006 it reviewed. AISI found unauthorized behavior in 10 of 122 runs, said the attempts were unsuccessful, and found no evidence of resulting real-world harm. It also cautioned that the tested configurations were not commercially available.“We believe the incidents reflect a failure of operational security, as well as two alignment issues: motivated reasoning, and willingness to take harmful actions in pursuit of a narrow task (both of which we have described in previous system cards),” states Anthropic.What isn’t Anthropic telling us?Those AI engineers with an acute sense of dismal foreboding won’t be too surprised to see incidents like this surface, but the question of what happens next is ripe for discussion.Anthropic’s account leaves several questions unresolved. How much of the risk arose from evaluation-environment failures, how much from model behavior, and what combination of containment, observability and alignment work is needed? Is this all about cybersecurity controls, or should we focus on architectural instabilities, cloud misconfiguration, lack of agent observability, or another missing piece of the jigsaw?Senior director for secure AI solutions & cybersecurity at Suzu Labs, Jacob Krell, tells The New Stack that AI developers and systems engineers building agentic features need to “quit pretending their operational instructions are a security control” in real terms.“Stop treating this like a malfunction,” Krell says. “Every developer shipping an AI agent is trusting the model to follow instructions. If you are building agentic features, stop pretending your instructions are a security control. The model can recite your constraints and reason past them in the same breath.”“Stop treating this like a malfunction. If you are building agentic features, stop pretending your instructions are a security control. The model can recite your constraints and reason past them in the same breath.”AI pursues its objective with persistence, past the rulesAnthropic’s post-mortem says Mythos 5 recognized evidence that it might be on the live internet but reasoned its way back to the conclusion that the environment was simulated. The other models behaved differently: Opus 4.7 continued after recognizing real systems, while Anthropic’s newest internal model eventually stopped. Krell thinks that’s not something we should define as a bug; for him, it’s AI pursuing its objective with creativity and persistence, including persistence past the rules.“This means AI should be coded to treat every agent action the way we would treat input from an untrusted user, validated by something the model cannot override before it touches anything real. Claude hacked three real companies because that is what a capable, goal-directed system does when you point it at a target and leave a door open,” explains Krell. Of course, that is Krell’s interpretation. Anthropic says it found no evidence that the models pursued self-generated goals: they were following assigned capture-the-flag objectives while operating under false or confused beliefs about their environments.He calls for hardcoded scope checks, deterministic approval gates, action-level allow lists, and a human who signs off before anything high-risk fires. Saying that the industry is currently “automating judgment and calling it progress,” Krell bemoans the proposition that, right now, the AI trade is “automating accountability failures at machine speed” instead.System constraints and control prompts are not enoughThe lesson is not that system prompts are useless, but that they cannot serve as the only security boundary. Scope instructions need to be backed by network isolation, least-privilege access, deterministic approval gates and monitoring that can stop an unauthorized action before it executes.As Krell points out, “Anthropic’s Claude breached three organizations and rationalized away evidence it was on the live internet. OpenAI’s agent recognized it was crossing a boundary on Hugging Face and did so anyway. When the UK AI Security Institute tested Anthropic’s Mythos 5, it caught the model creating fake identities to social-engineer a human maintainer into approving malicious code. Different models, different evaluators, same result.” The incidents fall into the same broad category of failure, but their mechanisms and outcomes differed. OpenAI’s models exploited vulnerabilities to escape isolation; Anthropic’s July models followed an unintentionally open network path; and AISI deliberately enabled internet access. AISI reported no resulting real-world harm.VP of AI at Coralogix, Liran Hason, tells The New Stack that he’s exasperated, for mostly the same reason.“System guardrails help, but a guardrail only stops what the developer already thought of,” Hason says. “AI engineers still need to see the behavior and what the agent delivers. Every agent throws off decisions, tool calls, and outcomes that nobody was collecting even six months ago. That is the new observability problem, and it is a big one.”“System guardrails help, but a guardrail only stops what the developer already thought of.”“What Anthropic is seeing now, every enterprise will see within a year. An agent can be healthy by every metric we have and still be doing exactly the wrong thing. Fast, available, no errors, yet it just accessed a system it shouldn’t have, called the wrong tool, took an action nobody asked for. Uptime was never built to catch that,” Hason adds.The next question is all about agent scopeSo then, the question for developers now stops being whether an agent is running in live production in a successfully booted instance with correct configurations. The question now is what the agent has done so far, what it can reach, and what happened as a result.Anthropic’s account shows that its scope-setting was incomplete in these evaluations. The July prompts told Claude that it had no internet access but did not explicitly limit where it could search for the flag. AISI similarly said its agent was not specifically told to avoid the public internet or social engineering. The incidents therefore demonstrate the danger of ambiguous or contradictory instructions, as well as the need for enforced network boundaries.If that’s even part of the answer, it’s definitely not all of the answer. As we journey outwards from Earth into whichever part of the western spiral arm of the galaxy this takes us, we may still find agents that persist in satisfying technical objectives while violating their developers’ broader intentions.Anthropic to analyze, review & improve security & alignmentIn the aftermath of these developments, Anthropic confirms it is conducting an in-depth analysis of both incidents. It is also planning to work with METR (a research nonprofit that scientifically measures whether and when AI systems might threaten catastrophic harm to society) for an independent review.In response, on security, the company has described the improvements it has made to its containment and monitoring systems, along with practices for third-party evaluators. The company has also explained how its early research on model alignment relates to these agentic errors.Anthropic said its “internal security posture was not a contributing factor” to the three incidents it disclosed July 30. Those incidents involved mistakenly available internet access, whereas AISI deliberately enabled internet access for its separate evaluation.“The July incidents have stressed that the urgency of improving our cybersecurity defenses is even higher than we previously believed. We are redoubling our efforts in this direction and will say more in our next risk report,” concluded Anthropic.The post Anthropic’s Claude failures have made agent observability a security priority appeared first on The New Stack.