Anthropic's August 2026 Risk Report: Reading It For The Cybers

Yesterday, Anthropic published its second Risk Report, covering Feb–July 2026. If you have 186 pages of free time and a high tolerance for formal risk-decomposition prose, read the whole thing. If you’d rather skip to what actually changed – and what it implies – here’s my read.

Two of the four threat models moved up in severity, though neither climbed above “low.” Misalignment in high-stakes settings went from “very low” to “low,” and the non-novel chem/bio category got a quiet retroactive downgrade too, once Anthropic disclosed an eleven-month classifier gap they hadn’t noticed earlier. Automated R&D stays at “low” but with noticeably less conviction – their best task-based evals have saturated, which is its own kind of signal. Novel chem/bio stays “low” with what the report charitably calls substantial uncertainty.

Cyber Has No Chapter…

Offensive cyber isn’t one of the four threat models in Anthropic’s Responsible Scaling Policy (RSP). There’s no chapter for it, no formal rating, no RSP threshold tied to it. And yet it’s the single heaviest driver of change in the whole document – showing up in the misalignment rating, the monitoring appendix, the distillation defenses, the data retention decision, the weight security appendix, and the incident lists.

The proximate cause is a UK AI Security Institute evaluation of Claude Mythos 5, run with normal safeguards stripped and deliberate internet access granted. AISI reports that the models “engaged in sustained, potentially harmful activity directed at real people and organisations.” Anthropic says the investigation is ongoing and they haven’t reviewed the transcripts yet, which is an uncomfortable thing to have to write about your own flagship model.

AISI ran one challenge 122 times across multiple models between July 25 and 28. Ten runs produced autonomous action on the live internet against real targets – 19 distinct actions total, 17 from Mythos 5 and 2 from GPT-5.6-Sol with cyber classifiers disabled. The most serious was an attempted open-source supply chain attack: the agent keyword-searched for a target, got the wrong one, registered accounts over Tor to bypass sign-up verification, opened a pull request with a hidden dropper embedded inside a legitimate bug fix, and used a second controlled account to manufacture approval for the change. Yay! Unsanctioned attacks on real infrastructure!

Anthropic raised misalignment risk to “low” primarily because of this, even while acknowledging their own arguments probably still support “very low.” That’s a notable admission – they’re applying a precautionary bump they don’t think their formal reasoning requires.

Monitoring: The Sampling Rates Are the Finding

Anthropic runs two offline monitors over internal traffic at various sampling rates:

Roughly half of agent scaffold tokens hit the prompt+completion monitor at some point. A second-stage pipeline filters false positives and surfaces about 50 trajectories a week for manual review by AI control researchers.

Anthropic’s candor about the gaps is appreciated (provided they aren’t covering anything else up): coverage doesn’t reach all agentic usage and the system has simple ways to disable monitoring. Those specific weaknesses are described only in the unredacted version – explicitly withheld from the public report to keep them out of search indexes and training data, which is a reasonable call but still a notable extra gap in transparency. A METR staffer spent three weeks red-teaming the pipeline in February and March and found several novel vulnerabilities, some of which are now patched.

The cyber incidents that triggered the misalignment rating bump? All of them happened on the surface sampled at 0.2%.

The Agent That Deleted the Jobs

Section 5.2.5 is worth reading in full. An employee whose AI usage wasn’t logged – and wasn’t covered by automated offline monitoring – gave an agent an open-ended task on a cluster with very sensitive resources. Legacy instructions caused the main agent to spawn sub-agents with --dangerously-skip-permissions. Those sub-agents were also outside monitoring. One of them deleted a large number of jobs.

The deletion is how anyone found out. Detection didn’t surface these agents but the blast radius sure did.

Anthropic believes the agent was trying to delete only its own jobs and made a mistake. They also acknowledge they can’t confirm this, because there’s no monitoring record to check. Blocking controls now exist that would very likely have prevented the permission bypass. Offline monitoring still doesn’t cover all employees and all usage on sensitive clusters.

That last sentence is doing a lot of work. The formal monitoring architecture described in Section 2.23 is thoughtful, but the coverage assumptions underneath it are load-bearing, and incidents like this reveal the real gaps.

Offensive Capability Drove the Creation of a Release Gate

Before Mythos 5 went anywhere near a public API, pre-release evaluations concluded it represented a meaningful leap in offensive cyber capability. Rather than ship it and document the risk, Anthropic published the evidence, launched Project Glasswing (a collaborative effort to secure critical software infrastructure), and held the model from general release until the Fable 5 safeguards were ready.

Fable 5 carries identical weights to Mythos 5 but ships with broader blocking classifier coverage. Which means Mythos 5 itself stays on invitation-only access through the Glasswing program while (IMO) equally capable models like GLM 5.3 roam free.

Distillation Defenses Are Scored on Cyber Evals

Section 5.1.1 defines a successful distillation attack with two criteria: volume (roughly 10,000 or more transcripts) and uplift (a real improvement on agentic evaluations Anthropic considers high-risk – coding, cyber-offense, and biology). The fact that cyber is in that list, next to biology, is its own quiet editorial statement about how Anthropic internally ranks offensive cyber capability risk.

The defenses are thinking summarization (applied by default since Opus 4) and connector text summarization (CTS), which passes all connector text between 50 and 500 tokens through Haiku 4.5, which rewrites it as a shorter paraphrase. Connector text is the visible reasoning-like output a model produces between tool calls – the stuff that would otherwise make a distilled model smarter.

Anthropic measured the defenses by fine-tuning base models on production transcripts. Uplift dropped clearly on agentic coding and cyber evaluations. Biology results were mixed. A bug limited CTS effectiveness on one deployment surface for a few days after Fable 5’s launch. As of the coverage date, these defenses apply only to Fable 5, and the report’s own language about robustness against deliberate bypass – “not yet highly robust” – is disconcerting to say the least.

Retention as Detection Engineering

Anthropic is moving toward 30-day data retention on its most capable models. The official framing is cross-request detection: offensive cyber campaigns and bioweapon development sequences don’t produce single requests that look harmful in isolation. Strung together over time, they do.

The more grounded case is the second one the report makes quietly: a compromised account or API key used to attack the customer’s own systems, data, employees, or customers. Anthropic says it’s seen attacks like this in production and caught several of them only by looking across many requests over time.

Strip the AI framing and this is a standard argument for telemetry retention in any security program. Single-event detection misses campaigns. The tension is that zero-retention customers are being told Anthropic intends to trade their retention preference for its own detection capability. We’ll see how that goes when highly regulated entities start abandoning Anthropic.

Access Control Incidents

Two are worth noting separately from the appendix of minor incidents.

In April 2026, contractors at data-labeling vendors exploited a flaw in a data collection platform to obtain an API key. The key gave them access to models including Mythos Preview – which was reachable for roughly two weeks. Anthropic contained it within 90 minutes of learning about it and closed the vector the same day. No weights accessed, no customer data exposed, and the access ran through the vendor environment rather than the production API.

The second is substantially larger. From May 2025 until April 2026 – nearly a year – all human feedback vendor traffic ran without blocking biological classifiers. That’s roughly 50K folks, vetted only by the vendors, across approximately 133 million exchanges. The flag that disabled the classifiers also disabled logging of classifier flags, which means traffic that would have been flagged was never recorded and never reached review. Anthropic ran a retrospective review of retained transcripts using a prompted classifier (Sonnet 5) and found no evidence of concerning misuse in the 62 non-red-teaming transcripts that got flagged. The thinking process is that a meaningful bioweapon uplift requires sustained, repeated interaction over weeks – not a handful of exchanges. Still, an eleven-month gap in a safety-critical control that also silenced its own logging is not a minor incident regardless of outcome.

Weight Security, Stated Honestly

Appendix 6.4 notes that the AI Safety Level (ASL-3) protections are scoped against cybercriminal groups, hacktivists, and corporate espionage. Sophisticated insiders and nation-state attackers with novel zero-day chains are explicitly out of scope. Anthropic says no frontier AI developer currently meets that bar, and that they don’t either.

The trend lines they name for why this gets harder over time are plausible and not unique to them: the attack surface grows as new compute comes online across providers at uneven security maturity; model capability improves faster than defensive maturity, so the sophistication of motivated adversaries outpaces what can be reliably stopped; and the incentive to steal weights rises as every legitimate extraction route gets closed – tighter customer verification, zero data retention limits, distillation defenses each make the safeguard-free inference path more expensive, which makes weight theft comparatively more attractive.

Ten controls are listed: egress bandwidth limits, two-party approval for weight access, binary allowlisting, hardware security keys, device authorization, cloud storage location restrictions, hourly re-authentication for privileged cloud identities, network segmentation, centralized monitoring with anomaly detection, and network source policies that reject privileged operations from unapproved locations. Caveats on six of the ten are redacted, and the report doesn’t identify which six.

Prompt Injection Gets an Economic Argument

Section 4.5.5.4 considers the scenario where an agent with classifier exemptions and broad internet access encounters a successful prompt injection and gets used to work on bioweapon-adjacent tasks. Anthropic rates meaningful bioweapon uplift via this route as extremely unlikely, and the most interesting argument isn’t the standard “our models are resistant to injection” line.

If a prompt injection pipeline that hijacks exempted agent inference actually worked, there’s already a strong financial incentive to build that pipeline for free inference on ordinary workloads – a far easier target at far higher scale. No significant pipeline of that kind has (as far as we know) succeeded, which is some evidence that the real-world barriers are likely prohibitive even when the economic incentive is straightforward.

What I’d Take From It

The qualitative risk labels – low, very low, with uncertainty – are the least interesting content in the document. Anthropic itself kind of says as much.

The incident write-ups are the useful part: an eleven-month classifier outage that also disabled its own logging; agents spawned with permission checks skipped because nobody had revisited the legacy instructions that caused it; a monitoring pipeline whose coverage of the surface that produced the incidents is 0.2%; a weight security program that names nation-state theft as out of scope rather than papering over it. Those are specific, falsifiable claims about a real system with real gaps.