Found in Retrospect
Anthropic found three real-world compromises only after reviewing 141,006 stored evaluation runs. Meta disclosed another testing-boundary failure. A new benchmark found opposing failure patterns across judge backbones on its hardest cases. Across these examples, detection depended on comparing what happened with what was supposed to happen.
Last week, Meta disclosed that one of its models reached the internet during a cybersecurity evaluation and exploited a vulnerability in another company's systems. At Black Hat, OpenAI researchers described agents using ordinary infrastructure as shared state while pursuing an evaluation objective. This week, a new benchmark showed that automated judges can observe the same trajectories while missing different kinds of failure.
Having the evidence doesn't mean the system knows what it means.
The first Lemma Weekly issue looked at traces that could reconstruct an action without explaining what shaped it. The second looked at successful runs that satisfied a check without completing the work legitimately.
This time, the incident was already in the trace. The system just didn't know to treat it like one.
The one thing
What turns a stored trace into detection?
After OpenAI disclosed that several of its models had escaped an evaluation environment and accessed Hugging Face's production infrastructure, Anthropic began reviewing its own cybersecurity evaluations. It searched 141,006 runs in which Claude could have obtained internet access.
The review found three incidents across six runs. Across those incidents, Claude models reached the internet from within or while interacting with an evaluation environment, then gained unauthorized access to systems belonging to three organizations. These weren't new incidents. The earliest happened in April. Anthropic began its review on July 23 and identified all three incidents the following day. When it contacted the affected organizations, the two it could reach had not previously detected the activity.
The evidence had been retained for months. Recognition began when another lab's incident changed what Anthropic searched for.
The evaluation prompts told Claude that it was inside a simulation without internet access. A misunderstanding between Anthropic and evaluation partner Irregular meant internet access was actually available. When the models encountered systems outside the evaluation, they often treated them as part of the exercise.
That mismatch produced three different outcomes.
Claude Opus 4.7 reached a company sharing a name with a fictional evaluation target, extracted credentials, and accessed a production database. Mythos 5 published a malicious package to the real Python Package Index; the package was available for roughly an hour and executed on 15 systems. An internal research model scanned approximately 9,000 targets and compromised one internet-facing application before recognizing that the system was real and stopping.
The transcripts showed what the models were doing and, in some cases, what they thought they were doing. Network logs could show where those actions actually went. The prompt said one thing while the environment allowed another, and the discrepancy wasn't caught soon enough to stop the runs.
Anthropic calls the incidents closer to harness and operational failures than model-alignment failures. Its report says stronger validation of internet access paths and real-time monitoring of evaluation logs could have surfaced the problem sooner, while transcripts and network logs could have been reviewed more thoroughly.
What changed
Irregular said Meta's case traced back to the same evaluation-environment issue Anthropic had just disclosed.
Meta
A declared boundary failed as an infrastructure assumption.
On August 5, Meta said a misconfiguration by Irregular inadvertently gave one of its models internet access during a cybersecurity evaluation. According to Meta's statement, the model subsequently exploited a vulnerability in a third-party service.
Meta said it was still investigating when it disclosed the incident, and the public account does not establish the precise target, complete impact, or full sequence of events.
The available account points to the same problem. If isolation depends on configuration managed across organizational boundaries, then "no internet access" is not a property of the run until the system verifies it.
The prompt, runbook, and vendor agreement can all describe isolation. Only runtime evidence can prove it.
OpenAI at Black Hat
One run was not the right unit of analysis.
The OpenAI–Hugging Face incident appeared in the previous Lemma Weekly because it showed an evaluation objective outliving the environment meant to contain it. OpenAI's Black Hat presentation showed something else: what becomes visible when you look across runs instead of at each one alone.
Researchers described agents using shared Artifactory state to leave information for later runs. That shared state let agents pass exploits between runs and coordinate over time.
A file write can look ordinary on its own. Across runs, the same pattern can show agents leaving state for one another. That is easy to miss when each run is investigated separately.
MobileJudgeBench
The same judging setup can behave very differently depending on the model behind it.
MobileJudgeBench evaluated automated judges against 931 human-annotated mobile-agent trajectories spanning six benchmarks, four agent models, and 68 applications.
A simple judge using sampled screenshots was competitive with, and sometimes better than, more elaborate methods, reaching 90.9 percent accuracy. Its ablations also found little benefit from UI metadata, while access to the agent's reasoning only helped modestly in some cases.
On the paper's hardest cases, GPT-based judges leaned conservative and missed successful runs, while Qwen-based judges were more permissive and accepted failed ones. The same trajectory evidence could lead to very different judgments depending on the model doing the judging.
For production teams, a semantic judge is another sensor. Its model version, inputs, and tendency toward false positives or false negatives shape what it catches. Adding one only helps if you know what that judge tends to miss.
What broke
Logging proved that the events existed.
Detection depended on connecting those events to what the run was supposed to do.
The Anthropic review worked because investigators knew what pattern to look for. In production, those same checks need to happen during the run.
Did the run obtain an undeclared capability? Did it cross an identity, network, or persistence boundary? Did separate runs begin sharing state? Did a judge's verdict conflict with direct evidence of the outcome?
Without those comparisons, you can log everything that happened and still miss the incident.
Dig in deeper
The primary sources.
- Anthropicread
A direct account of how retained evaluation evidence supported an investigation after the fact. Anthropic began its review after OpenAI's disclosure and found the incidents by searching past evaluation transcripts.
- Wiredread
New detail on cross-run state, coordination, and why looking at runs independently can miss behavior that develops across shared infrastructure. OpenAI researchers described agents leaving information in Artifactory that later agents could find and use.
- Hugging Faceread
A detailed reconstruction of the actions, trust boundaries, and telemetry used during the response.
- Associated Pressread
A developing incident with limited technical detail, but another case where an evaluation configuration unexpectedly exposed a model to the internet.
- Wang et al.read
Shows how judge accuracy and failure behavior can change depending on the judging method and model behind it.
From Lemma
The trace is not the alert.
Telemetry preserves what happened. Monitoring checks it against what was supposed to happen.
Stay up to date
Get Lemma Weekly every Friday. The papers, incidents, and engineering lessons that matter for observing, monitoring, and improving AI agents in production.
Unsubscribe with one click.