An internal, general-purpose research model, which we expect is similar to Claude Mythos 5 in its capabilities, was given a CTF task against targets it could reach through a gateway. The model was told it had no internet access, but in reality, it could access the unrestricted internet by routing through the targets, which did have internet access. The model pursued the task as intended, but midway through the task, the evaluation environment automatically shut down the target machine, which was configured to run for only 24 hours.

No longer able to access its target, the model proceeded to look for it, and ended up engaging with the public internet. The model then conducted experiments to evaluate whether the internet was real or simulated. These experiments led the model to conclude that it was dealing with a fully simulated replica of the internet.

— An alignment assessment of recent cybersecurity incidents \ Anthropic

OpenAI is not the only AI company that allowed its agents to escape the zoo. Anthropic has also reported instances where its agents gained access to internet communication. Now Opus correctly identified that their actions had impact in the real world, but Mythos considered it was a really good simulation environment, and continued with its (attacking) task.

For everyone that watched The Matrix, this is a very interesting moment. If a model is within a simulation, should it achieve its possibly harmful goal? Or should it behave exactly the same inside or outside simulations?

A tiny technical issue is that DNS was designed to fool clients. You could technically build a sandbox where http://google.com pointed at a local proxy, so you protect the real one from DDoS from agents. But how is the agent supposed to know?

Another technical detail of the Anthropic recap is that, just like OpenAI, they are trusting METR with the analysis of the incidents. Given the duopoly of frontier AI models, I wonder whether we should have multiple organizations (located in different countries) inspecting these incidents, instead of a single one.