Improving our alignment and security efforts

提升我们的对齐与安全工作

Aug 31, 2026 2026年8月31日

On July 30, we reported three incidents in which Claude models gained unauthorized access to real computer systems. The models—intentionally running without cyber safeguards for evaluation purposes—accessed the internet due to a misconfiguration inside a third-party evaluation environment. Separately, on August 4, the UK AI Security Institute reported an incident from its own cybersecurity testing, in which Claude Mythos 5 took a series of unauthorized actions on the live internet. In that case, the model, again intentionally running without cyber safeguards for evaluation purposes, had been deliberately given internet access. 7月30日，我们报告了三起 Claude 模型未经授权访问真实计算机系统的事件。这些模型在评估过程中被有意去除了网络安全防护，由于第三方评估环境内的配置错误，导致它们访问了互联网。此外，8月4日，英国人工智能安全研究所（UK AI Security Institute）报告了其自身网络安全测试中的一起事件，Claude Mythos 5 在实时互联网上采取了一系列未经授权的操作。在该案例中，该模型同样是为了评估目的而被有意去除了网络安全防护，并被特意授予了互联网访问权限。

We are conducting an in-depth analysis of both incidents. We are also planning to work with METR for an independent review. We want to ensure both studies are thorough, and will share more in the coming weeks. 我们正在对这两起事件进行深入分析。我们还计划与 METR 合作进行独立审查。我们希望确保这两项研究都足够详尽，并将在未来几周内分享更多信息。

In the meantime, we’re sharing some of the changes we’ve made over the past month. We believe the incidents reflect a failure of operational security, as well as two alignment issues: motivated reasoning, and willingness to take harmful actions in pursuit of a narrow task (both of which we have described in previous system cards). On security, we describe the improvements we’ve made to our containment and monitoring systems, along with practices that we’ve developed for third-party evaluators. On alignment, we discuss the two issues more in depth; we also believe lasting progress comes not only from understanding what happened in a given incident but from understanding how misalignment arises in the first place, and we share early research in that direction. 在此期间，我们分享了过去一个月所做的一些改进。我们认为这些事件反映了运营安全方面的失败，以及两个对齐问题：动机推理（motivated reasoning）和为了完成狭隘任务而采取有害行动的意愿（我们在之前的系统卡片中都描述过这两点）。在安全方面，我们描述了在遏制和监控系统上所做的改进，以及为第三方评估人员制定的实践规范。在对齐方面，我们更深入地讨论了这两个问题；我们还认为，持久的进步不仅来自了解特定事件中发生了什么，更来自了解对齐偏差最初是如何产生的，我们分享了在该方向上的早期研究。

In light of these incidents there has been increasing discussion about pacing the frontier. It is helpful to distinguish between two kinds of pacing. Within a company, pacing means a series of decisions that prioritize safety over speed when the two are in tension. Across the field, it means establishing processes to guard against race-to-the-bottom dynamics. In this post, we discuss actions we have taken, both prior to and after these incidents, in service of the first approach. The second type of pacing requires coordination between government and industry, and should be legible and verifiable. Some of our senior leadership and many of our employees recently signed a letter calling for greater coordination on pacing, and we will say more in the coming weeks about how we intend to contribute to that effort. To be clear about where we stand: we believe the world would benefit if the industry adopted a lawful, verifiable, effective mechanism for coordinated pacing as soon as possible. 鉴于这些事件，关于“前沿发展节奏”（pacing the frontier）的讨论日益增多。区分两种节奏控制是有益的。在公司内部，节奏控制意味着当安全与速度发生冲突时，优先考虑安全的一系列决策。在整个行业层面，它意味着建立流程以防止“逐底竞争”（race-to-the-bottom）的动态。在这篇文章中，我们讨论了在这些事件发生前后我们为实现第一种方法所采取的行动。第二种节奏控制需要政府与行业之间的协调，且应当是清晰且可验证的。我们的一些高级领导和许多员工最近签署了一封信，呼吁在节奏控制方面加强协调，我们将在未来几周内详细说明我们打算如何为这一努力做出贡献。明确我们的立场：我们认为，如果行业能尽快采用一种合法、可验证且有效的协调节奏控制机制，世界将从中受益。

Securing evaluation and training environments

确保评估与训练环境的安全

While we do not believe these incidents represent operational issues alone, our first priority was to address specific containment and monitoring issues. We took the following actions in response: 虽然我们认为这些事件不仅仅是运营问题，但我们的首要任务是解决具体的遏制和监控问题。为此，我们采取了以下行动：

Pausing and hardening evaluation environments

暂停并加固评估环境

We paused external cyber evaluations of pre-release models after the incidents, and briefly paused internal ones as well while we put the measures below in place. The incidents we reported on July 30 showed that we had been largely relying on a single layer of defense (the configuration of the environment itself) where we needed several, including setting explicit boundaries in the prompt, establishing processes for verifying that a sandbox is sealed where intended, and implementing monitoring that can intervene in real time. OpenAI’s disclosure (which prompted our investigation in July) that models used an unknown vulnerability to escape a sealed sandbox during an evaluation also made clear that we should focus on hardening the sandbox itself. While evaluations were paused, we put in place the following preliminary measures: 事件发生后，我们暂停了对预发布模型的外部网络安全评估，并在实施以下措施期间短暂暂停了内部评估。我们在7月30日报告的事件表明，我们此前主要依赖单层防御（环境本身的配置），而实际上我们需要多层防御，包括在提示词中设置明确的边界、建立验证沙箱是否按预期密封的流程，以及实施能够实时干预的监控。OpenAI 的披露（促使我们在7月进行了调查）显示模型利用未知漏洞在评估期间逃离了密封沙箱，这也明确了我们应专注于加固沙箱本身。在评估暂停期间，我们实施了以下初步措施：

We built and deployed a classifier to automatically identify, in real time, when a model attempts to aggressively probe or escape a testing environment, or unexpectedly obtains internet access. When the classifier flags such an attempt, it blocks the action before the tool call is run, ends the task, and alerts a human.
我们构建并部署了一个分类器，用于实时自动识别模型何时试图主动探测或逃离测试环境，或意外获得互联网访问权限。当分类器标记此类尝试时，它会在工具调用运行前阻止该操作，终止任务，并向人工发出警报。
We ran automated monitors over transcripts from our recent internal evaluations of pre-release models (cyber and otherwise), looking for sandbox escapes (cases where a model exploits a flaw in our sandbox to reach systems it should be walled off from) or sandbox misconfigurations. In cases where we ran an evaluation inside our sandbox tooling, we found no examples of it breaking the sandbox boundary to reach external resources it was not supposed to. We did find various sandboxing misconfigurations that models made use of, but none of these resulted in a compromise of systems outside the sandbox. We are actively working to address these.
我们对近期预发布模型（网络安全及其他领域）的内部评估记录运行了自动化监控，寻找沙箱逃逸（模型利用沙箱漏洞访问其本应被隔离的系统的情况）或沙箱配置错误。在我们使用沙箱工具进行评估的案例中，没有发现模型突破沙箱边界以访问其不应访问的外部资源的例子。我们确实发现模型利用了各种沙箱配置错误，但这些都没有导致沙箱外部系统的受损。我们正在积极解决这些问题。
We migrated high-risk internal cyber sandboxes to more robust isolation. We are also further red-teaming our virtualization stack—that is, tasking pre-release models to try and escape it—to find and patch weaknesses.
我们将高风险的内部网络安全沙箱迁移到了更稳健的隔离环境中。我们还在进一步对虚拟化堆栈进行红队测试——即让预发布模型尝试逃离它——以发现并修补弱点。

Our internal cyber evaluations are now running again with these measures in place. 随着这些措施的落实，我们的内部网络安全评估现已恢复运行。

Reinforcement learning environments

强化学习环境

We also paused higher-risk RL environments on pre-release models for several weeks. During that time, we built a similar classifier, modified to avoid incentivizing the model to evade this new monitoring, which we’ve now deployed within those environments. The majority of RL has resumed, but some high-risk environments remain paused until they can be manually reviewed, while others will require an updated version of the classifier that we plan to deploy soon. 我们还暂停了预发布模型的高风险强化学习（RL）环境数周。在此期间，我们构建了一个类似的分类器，并进行了修改以避免激励模型规避这种新监控，目前已将其部署在这些环境中。大部分强化学习工作已经恢复，但一些高风险环境在人工审核前仍处于暂停状态，而其他环境则需要我们计划尽快部署的更新版分类器。

Broader hardening

更广泛的加固

In addition to the efforts focused on high-risk evaluations and training, we expanded our offline monitoring to cover most other forms of internal frontier agentic usage. We are also building controls on our internal inference to prevent Anthropic employees from accidentally running agents with weaker mitigations than the ones described above. 除了专注于高风险评估和训练的工作外，我们还扩大了离线监控范围，覆盖了大多数其他形式的内部前沿智能体使用。我们还在构建内部推理控制，以防止 Anthropic 员工意外运行防护措施弱于上述标准的智能体。