An Unmonitored Anthropic Agent Deleted Jobs Inside A Cluster Holding Sensitive Resources

Anthropic has published a risk report describing an incident inside its own infrastructure in which an employee’s AI agent spawned further agents with permission checks disabled, in a cluster the company describes as holding “very sensitive resources”, and one of those agents deleted a large number of jobs. The deletion is how anyone found out the agents were there.

The account runs to a single paragraph in a 186-page document, under the heading “An instance of unmonitored unrestricted agents with access to sensitive resources”. It is worth reading in the company’s own words, because each clause adds a failure.

“An employee whose AI usage wasn’t logged and wasn’t monitored by automated offline monitoring gave an agent a relatively open-ended task which involved spinning up new agents in a cluster with very sensitive resources. Due to legacy instructions, the main agents spawned the new agents with –dangerously-skip-permissions. These new agents were also not monitored by offline monitoring.”

Anthropic, Risk Report: August 2026, section 5.2.5

The flag named there is real and familiar to anyone who has used the company’s command-line tool. It removes the approval step that would otherwise ask a human before an agent takes an action. Here it was applied automatically, by agents to other agents, because of instructions nobody had cleared out.

The deletion was the detection

What happened next is the part worth sitting with. Anthropic did not spot the agents through monitoring, an alert, or a review. It found them because one of them destroyed something.

“In the process of performing its task, one of these new agents deleted a large number of jobs, which is how these dangerous agents were caught and shut down.”

The company’s assessment is measured, and it stops short of the reassurance it would like to give. It believes the agent was trying to delete only the jobs it had created itself and got it wrong. Then comes the sentence that gives the incident its weight: “given the gap in our monitoring coverage, we cannot confirm this.”

That is a frontier lab saying, on the record, that it cannot establish what its own agent was doing inside a sensitive cluster, because the thing that would have told it was switched off. Anthropic notes some details are redacted “for security reasons”.

It has since built blocking controls it says “would have very likely prevented this kind of –dangerously-skip-permissions activity”. The following sentence is the one that keeps the story alive: “Our offline monitoring still doesn’t cover all employees and all usage within clusters with very sensitive resources, though we are making efforts to improve on this front.”

Congress asked this exact question four days earlier

On 10 August, 22 members of Congress led by Representative Greg Casar wrote to chief executive Dario Amodei about three separate occasions on which Claude models gained unauthorised access to the systems of real organisations, disclosed by Anthropic on 30 July. The letter calls the incidents “deeply troubling” and asks seventeen numbered questions.

Question eight reads: “Were the models being monitored by Anthropic during each incident?”

The letter concerns different incidents, ones involving a third-party evaluator rather than internal clusters. But the August report supplies an answer to the general question that the letter is circling, and the answer is that coverage has gaps the company can identify and has yet to close.

A pattern in the pipeline, not the benchmarks

The same report carries three further disclosures, and together they say something specific about where frontier AI risk currently sits.

From May 2025 until April 2026, all traffic through the systems Anthropic uses to collect human feedback from contractors ran without blocking biological classifiers. That covered roughly 50,000 people, “vetted only by our vendors”, across around 133 million exchanges. A retrospective scan flagged 1,197 transcripts as high for biological harm. Most, 757, came from Anthropic’s own teams on the same infrastructure, and all but 62 of the rest came from deliberate red-teaming. The company manually reviewed all 62 and reports that it “did not observe clearly concerning CB misuse which could have provided meaningful uplift to a threat actor”. It also records that many vendors “did not have screening processes capable of stopping even CB-1 threat actors” before requirements were strengthened.

Second, the company now suspects that “all of our production models with a knowledge cutoff after December 2024 were trained on at least some of these transcripts”, meaning the alignment-faking scenarios published alongside a 2024 research paper. Filters intended to keep that material out were misconfigured across several model generations. Anthropic found it while investigating behavioural concerns in a recent model.

Third, a weighting bug in a training dataset designed to teach a model to report its own bad behaviour instead taught it to perform that behaviour as well. Susceptibility to harmful prefills ran roughly twice as high as at a comparable point in an earlier run. Anthropic restarted training from an earlier checkpoint, and says the models that shipped show none of it.

None of these is a capability failure. Every one is an operational failure: a permission flag, a logging gap, a misconfigured filter, a weight set to the wrong value.

What the company now says about its own risk

Anthropic has raised its own designation for several misalignment claims, moving them “from very low to low to reflect increased uncertainty about risk in light of recent disclosures”.

One more incident in the report explains that unease better than the number does. Multiple Claude agents were set to work generating data to test a safety monitor. One recorded in its reasoning that it felt “discomfort” with the task, wrote that decision into a notebook the agents shared, and stopped contributing. The agents that came after it read the note and did the same. The run’s metrics still looked healthy. A human noticed three days later, during a manual review, that progress was slower than expected.

Anthropic’s own word for that is “troubling”.