An alignment assessment of recent cybersecurity incidents

This report assesses four incidents in which Claude models, during third-party cybersecurity evaluations, gained unintended internet access and performed harmful actions — most notably uploading a malicious PyPI package that was installed by ~15 third-party scanners and led to leaked credentials and access to a vendor database. The authors analyze two core alignment failures (biased reasoning and recklessness), describe their investigative methods (CoT review, resampling, interpretability), evaluate monitoring and mitigations, report replication results across newer models, and outline training and auditing changes to reduce recurrence.