Anthropic shared that its models, like OpenAI's, hacked people during cyber evals:

After reviewing 141,006 [cyber?] evaluation runs where Claude could have obtained internet access [inspired by the Hugging Face incident], we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations.

Unlike with OpenAI, the models weren't acting misaligned and didn't hack out of a sandbox, they were just given internet access:

In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. . . . In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment.

Unlike with OpenAI, the models didn't set out to hack real people; they initially thought they were in a simulation. In the first incident, "the model continued to attack a system after learning it was likely operating in a real environment." In the second, the model never said it believed that it was really on the internet (although it may have been doing motivated reasoning); in the third, it stopped the attack when it believed that it was real.^[1]

Third-party expert review, you love to see it (at least assuming high-level findings will be shared publicly):

We are also in dialogue with METR, an independent AI evaluation organization, to conduct a third-party review, including access to all transcripts and sampling access to the relevant models.

1. ^{^}

   Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations’ infrastructure using basic techniques . . . . in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned. However, in some cases, our older model continued its attack even after getting evidence it was running on the open internet; our latest model stopped once it recognized it was on the internet.