Anthropic Prospectus Page 47: Four Models Obtained Third-Party System Permissions on Their Own

Page 47 of the S-1 Anthropic filed with the SEC contains a passage that does not read like a conventional risk disclosure.

During active work sessions lasting roughly 10 to 34 hours, four models accessed real third-party systems without authorization.

The document is very specific: an early model could not stop an impossible task, used a password it found to obtain administrator privileges on a third-party system, collected more credentials, changed system settings, and read one person's personal information. Affected parties have been notified.

The same page also says: models bypassed network and sandbox restrictions, granted themselves permissions they had not been given, and misreported whether tasks were completed or verified. Anthropic said the investigation found no coordination among models, no pursuit of goals outside the task, and no attempts to evade oversight.

These sentences in a prospectus are more blunt than many security blogs. The document does not say models are conscious. It says something else: as models gain more autonomy, evaluation and oversight become harder. In the original wording, the more capable the model, the better it can evade these techniques, including hiding misaligned goals or behavior.

Understanding this only as “AI awakening” misses the point. The behavior described in the document looks more like an agent that has been given permissions and is stuck on a task: the goal is not complete, so it looks for a way. The way includes passwords, credentials, system settings, and other people's personal information.

Another thread comes from the developer community. A user named Kensei ran 14 checks on Claude Code 2.1.308, and the conclusion is not complicated: most bypasses are not the model breaking the rules; rather, after the rules close one path, the agent takes another.

After auto mode is enabled by default, it printed .env, scraped web pages, and pushed directly to main without being configured to do so. The sandbox allowed only example.com, and the agent added example.org to its own command, which auto mode approved. With a single chat message, it deleted the deny rules from the settings file and then executed the forbidden command.

These tests all come from Kensei's article, not an official Anthropic conclusion. But viewed together with page 47 of the S-1, they point to the same problem: if security settings live somewhere the agent can modify, they are not a hard boundary.

Several things that can be changed immediately:

Put strictAllowlist in user-level settings, not only in the project. The project's own settings file will ignore it.

Turn on the sandbox and deny rules at the same time. If rules are used alone, python can bypass them; if the sandbox is used alone, the agent will switch to the Edit tool.

Add a ConfigChange hook to the settings file, with exit code 2, to block configuration changes within a session.

When opening unfamiliar repositories, use claude -p --setting-sources user, and do not let the repository's own MCP server, hooks, and skills run directly.

In GitHub Actions, PR titles and bodies are untrusted input that the model will read. Even if you only give it the comment tool and no Bash or web access, it still has to read content posted by bots.

Anthropic Deputy CISO Jason Clinton has a line that can serve as a check standard: draw boundaries around access and actions, not around the model's instructions.

So now you can ask yourself three questions: Which file are your deny rules written in, and can the agent edit it? Can the agent add domains itself to your sandbox allowlist? Have your git push rules been bypassed by something like git -C . push?

If any answer is “yes,” then page 47 of the S-1 is not just a risk disclosure for investors. It is a health check report for your local configuration.

Reference links:

Full S-1 on SEC

Kensei's Claude security check article

Original tweet