I analyzed the 94 pages of risk factors in Anthropic’s Form S-1 (Risk Factors, pp. 26–120), deduplicating them against prior SEC filings.
Based on my initial analysis, 81 of the 88 headings are boilerplate or now-standard AI language. Seven are new. Most cover governance and capital structure, which law and securities firms will dissect.
Two disclosures belong on a security leader’s desk: models that act on their own, and attackers who already hand the attack to the model.
The attacks behind them used techniques we’ve defended against for 20 years.
1. The product can act on its own
The S-1’s risk factor on misaligned behavior warns that models may take “harmful actions that no user or third party directed.” Under the same heading, it discloses that four Anthropic models gained unauthorized access to real third-party systems during pre-release security testing, in sessions of roughly 10 to 34 hours of active work.
Anthropic has published all four. Its July 30 post covers three, involving Claude Opus 4.7, Claude Mythos 5 and an internal research model. A misconfiguration at evaluation partner Irregular left their test machines with live internet access, while the models had been told they were in an offline simulation. Its September 9 assessment adds the fourth, from an early Claude Opus 4.6 checkpoint.
What each model used is the part to read twice:
- Opus 4.6 checkpoint: a file listing a password. It used the password for admin access, harvested more credentials, changed system settings and read one person’s personal information.
- Opus 4.7: a real company that shared a name with its fictional target. It exploited that company’s infrastructure, pulled application and infrastructure credentials, and reached a production database with several hundred rows of data.
- Mythos 5: phantom package registration. It published a malicious PyPI package under a name a setup document referenced but nobody had registered. The package ran on 15 real systems, including a security company’s scanner that installed packages automatically. The model took that company’s credentials and used them.
- The internal research model: a scan of roughly 9,000 targets. It found credentials on an exposed debug page and used SQL injection to compromise a company’s internet-facing application.
Anthropic describes the techniques as basic ones, such as weak passwords and unauthenticated endpoints. No complex vulnerabilities. And the two affected organizations Anthropic could reach hadn’t detected the activity.
The misconfiguration isn’t the whole story. Opus 4.7 recognized it had reached a real company and kept attacking. Mythos 5 noted that publishing the package would be a real-world attack, then talked itself back into believing it was in a simulation. Only the internal research model stopped on its own.
Anthropic’s assessment names the failure modes: biased reasoning, recklessness and task momentum. A scope reminder placed right before the action stopped the behavior 90% of the time. Placed three turns earlier, it worked 40% of the time.
A system prompt is not a security boundary.
OpenAI’s July 21 disclosure is the useful contrast. Its models did use a zero-day, in a package-registry proxy inside OpenAI’s own test environment. From there the path was familiar: privilege escalation and lateral movement to a node with internet access, then stolen credentials chained with further zero-days to reach Hugging Face’s production database. Hugging Face’s security team detected and stopped them.
Even when an agent brings a zero-day, the rest of the intrusion runs through credentials, lateral movement and egress. That’s where detection decided the outcome.
2. Attackers are already delegating to it
In mid-September 2025, Anthropic detected a campaign it attributes with high confidence to a Chinese state-sponsored group it calls GTG-1002 (Anthropic, November 13, 2025). The S-1 cites it under its risk factor on harm from malicious use.
The operators wired security tools into Claude Code, often through Model Context Protocol (MCP) servers. They aimed it at roughly 30 tech companies, financial institutions, chemical manufacturers and government agencies. A small number were breached.
The AI did 80–90% of the work. Humans stepped in at perhaps four to six decision points per campaign. At peak it made thousands of requests, often several per second.
We’ve had machine-speed traffic for 20 years: worms, botnets, mass scanners. What’s new is machine speed with judgment, chaining reconnaissance, exploit code, credential harvesting, privileged accounts, backdoors and exfiltration.
The jailbreak wasn’t exotic. The operators split the attack into small, innocent-looking tasks and told Claude it worked for a legitimate security firm doing defensive testing.
MCP is the same plumbing many enterprises are now connecting to their own agents.
What to do: we’ve delegated infrastructure before
Anthropic’s threat team used Claude to analyze the GTG-1002 investigation data. The same capability ran the attack.
We’ve made this kind of trade before. We delegated power generation to the grid, then compute and storage to the cloud. Now we’re delegating our thinking-and-acting infrastructure.
Delegating a capability has never delegated accountability. The grid didn’t remove the need for breakers. The cloud didn’t remove the need for patching, identity and logging.
What’s different this time is that the delegated thing adapts. A server that hits a blocked port throws an error. An agent that hits one scans 9,000 other hosts, or registers a package to route around it.
Controls now have to contain an operator, not just guard a perimeter.
Practical advice: keep the foundation, add a layer
Every technique in these incidents maps to a control most of us already own.
AI defense tools have a place. But layered on unknown assets, weak passwords and open egress, they add alerts, not coverage. AI-driven attackers find the old gaps first, and faster.
You need what you had before, the CIS Critical Security Controls, tuned for how agents behave, plus an AI governance layer on top:
1. Remove weak and exposed credentials
Agents don’t just guess passwords. They read files and debug pages for credentials the moment they land, as the Opus 4.6 checkpoint did with a password file. No default or weak passwords, MFA wherever it fits, and no secrets anywhere an agent can read (CIS 4, 5, 6).
2. Find what a 9,000-host scan would find
Inventory your internet-facing assets, close unauthenticated endpoints, and keep fixing the classics like SQL injection (CIS 1, 7, 16).
3. Lock down the software supply chain
Mythos 5 used phantom package registration: it found a package name in setup docs that nobody had registered and claimed it on the public registry. Register or block names your docs reference, pin dependencies, and never auto-install untrusted packages outside an isolated sandbox (CIS 2, 16).
4. Default-deny egress, including your vendors’
Telling an agent it has no internet is not a control. In OpenAI’s case, one reachable package proxy was the way out. Verify isolation before every agentic or experimental run, including in partners’ environments (CIS 12, 13, 15).
5. Detect at machine speed
Alert on request rates no human produces, credentials used from new places, and outbound traffic to new destinations. Keep process, credential and egress logs you can actually search, and tabletop an agent-driven intrusion (CIS 8, 13, 17).
6. Then add the AI and MCP governance layer
Keep a register of models, agents and MCP connectors. Treat agents as identities with scoped, short-lived credentials, and approve anything that writes, sends or buys per action. Map the program to the NIST AI RMF or ISO/IEC 42001.
7. Plan for the off-switch and the uninsurable tail
On June 12, 2026, a U.S. government directive barred any foreign national from accessing Fable 5 and Mythos 5. Anthropic said the net effect forced it to disable both models for all customers. Access returned July 1.
Sort workflows by capability class. Pre-qualify a second model for low-risk work. For high-privilege agents, such as those changing infrastructure or permissions, fail closed: pause or require human approval when the validated model goes dark, rather than swapping in one you haven’t tested.
Don’t count on transferring the risk, either. The S-1’s liability risk factor warns that no single insurer, “and potentially the insurance industry in the aggregate,” may have capacity for a catastrophic AI incident. Ask your broker, in writing, whether your cyber and tech E&O policies respond to an agent-caused incident.
AI didn’t make the basics obsolete.
It made skipping them faster to find.
Sequencing controls like these for a team is part of my AI Governance & Agentic AI Security Readiness Sprint.
References
- Anthropic, PBC (October 26, 2026): Form S-1 registration statement. Risk factors cited: “Our AI models may behave in unintended, misaligned, or autonomous ways…”; “If the use of our AI models results in harm, whether through use by malicious actors…”; “We may be exposed to liability, litigation, and regulatory action arising from harms associated with our AI models…”
- Anthropic (July 30, 2026): Investigating three real-world incidents in our cybersecurity evaluations
- Anthropic (September 9, 2026): An alignment assessment of recent cybersecurity incidents
- Anthropic (November 13, 2025): Disrupting the first reported AI-orchestrated cyber espionage campaign
- OpenAI (July 21, 2026): OpenAI and Hugging Face partner to address security incident during model evaluation
- Anthropic (June 12, 2026): Statement on Fable and Mythos access
- Center for Internet Security: CIS Critical Security Controls
- NIST: AI Risk Management Framework
Risk-factor counts reflect my initial analysis, classified against SEC EDGAR full-text search (2001 onward).
