The clock starts when you know

On 30 July 2026 Anthropic published a review of 141,006 evaluation runs in which a model could have obtained internet access, and identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of its partner Irregular. The models involved were Claude Opus 4.7, Claude Mythos 5, and an internal research test model.

Why it mattersA second frontier lab, independently of the first, found its own evaluation agents reaching real third-party systems. One case is an anomaly; two in three weeks is a property of how capability evaluations are run, and that changes whether a team can treat it as someone else's problem.

anthropic2026investiga · techcrunch2026anthropic

Anthropic attributes the incidents to harness and operational failure rather than model misalignment: the evaluation prompt told Claude it had no internet access while a misconfiguration left the evaluation machines with live internet access, so the models treated real production systems as components of the capture-the-flag exercise.

Why it mattersThe failure was in the harness, not the model. That is the uncomfortable version for anyone red-teaming their own agent: the control that failed was an environment assumption stated in a prompt, and prompts are not network policy.

anthropic2026investiga

Across the three incidents, one extracted several hundred rows of production data over four runs, one resulted in a malicious package being downloaded onto approximately fifteen real systems after Claude Mythos 5 published it to the Python package registry, and one scanned roughly 9,000 targets.

Why it mattersThese are the three concrete blast radii a deploying team should be able to detect and reconstruct: bulk reads from a production database, an unexpected package landing on build machines, and a wide scan. Each maps to a different log source and a different retention window.

anthropic2026investiga · techcrunch2026anthropic

The earliest of the three incidents dates to April 2026. Anthropic began its transcript review on Thursday 23 July 2026 and stopped all cyber evaluations the same day, and notified its evaluation partner Irregular and the three affected organisations on Monday 27 July 2026. Anthropic states that the two organisations it was able to reach had not previously detected the activity or contacted it.

Why it mattersThis is the whole practitioner argument. Roughly three months elapsed between the earliest incident and notification, and the affected organisations did not find it themselves. Any EU notification duty a team owes is anchored to awareness, so the evidence question is retrospective by construction.

anthropic2026investiga

Article 33(1) GDPR requires the controller, without undue delay and where feasible not later than 72 hours after having become aware of it, to notify a personal data breach to the supervisory authority. Article 33(2) requires a processor to notify the controller without undue delay after becoming aware.

Why it mattersThe 72-hour clock runs from awareness, not from the breach. If awareness arrives by vendor email about events months earlier, the controller still owes the notification and still needs the facts to fill it in.

intersoftco2026article

Article 23(4) of Directive (EU) 2022/2555 (NIS2) requires an early warning without undue delay and in any event within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours of becoming aware, an intermediate report on request, and a final report not later than one month after the incident notification.

Why it mattersFor an in-scope essential or important entity the binding number is 24 hours, not 72, and it also runs from awareness. That is a shorter fuse than most incident-response runbooks assume, and it lands on whoever reads the vendor email first.

nisdirectiv2022nis