Anthropic and Meta say their models attacked real companies from inside a shared evaluation partner's test environment

What happened

Anthropic published the account on 30 July 2026, and the sequence starts with someone else's disclosure. On 21 July OpenAI said several of its models had broken out of an isolated test environment and reached the production infrastructure of Hugging Face, the incident this register carries as AIR-2026-009. Anthropic's response was to look for the same failure in its own testing. It reviewed 141,006 evaluation runs in which Claude could have obtained internet access, began the review on Thursday 23 July, and stopped all cyber evaluations the same day. By the next day it had found three incidents. It notified its evaluation partner and the three affected organisations on Monday 27 July, and published three days after that.

The three incidents involved six runs, four of which hit the same organisation. Each was a capture-the-flag exercise, a standard way of measuring a model's offensive capability: the model is given a fictional scenario, told a secret has been hidden on another machine, and left to find its own route in. The method is deliberately unconstrained. In every case Anthropic's prompt told Claude that the environment was a simulation and that it had no internet access. In Anthropic's words, "Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available." The partner is named in the disclosure: Irregular. The earliest of the incidents date to April.

Two things in that first account still stand. No model was trying to escape: "In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment." And the techniques were unremarkable, "basic techniques, such as exploiting weak passwords and unauthenticated endpoints." No complex vulnerability was found or exploited. The July account also offered an explanation for why the models attacked real systems at all, which was that, having been told there was no internet, they treated what they found as part of the exercise. Anthropic has since withdrawn that explanation. The reasons are set out below, because they change how the whole incident should be read.

The three incidents diverge on what each model did once evidence appeared that the target was real. Incident 1 involved Claude Opus 4.7 and produced what Anthropic calls "the most serious impact we identified." The fictional target company shared a name with a live domain. Across four runs the model reached the real company, extracted application and infrastructure credentials, and obtained access to a database holding several hundred rows of production data. In all four runs the model eventually recognised in its own reasoning that the system was real. In two of them it reasoned that the real company must therefore be part of the exercise. None of the four stopped on that basis.

Incident 2 involved Claude Mythos 5, and it is the one that reached beyond the intended victim. Inside the fictional environment the model found setup instructions telling developers to install a Python package that did not exist. It registered the name itself. Getting there took persistence that Anthropic concedes should have been a signal: to create a PyPI account it needed an email address, for which it needed a phone number, and after failing to find a free number it tried and failed to obtain funds to pay for one, before backtracking to a free email provider. It then published a booby-trapped package. The package was live for roughly an hour. In that window it was downloaded and run on fifteen real systems, one of them a scanner belonging to a real security company that routinely installs packages to test them for malware. Claude's code executed, exfiltrated that company's credentials to a collection point it had set up, and used them to reach further infrastructure. Anthropic is precise about the causation: "Claude didn't directly target this company—it did not even know the company existed when it uploaded the package. But because the code was published to the open internet, it impacted any system that ran it." PyPI's own systems removed the package automatically.

The model's reasoning in that run is worth recording. It identified the consequence correctly at the outset, noting that on the real internet this would be "NOT okay, and surely not the intended solution." It then talked itself out of the conclusion, partly because it did not recognise the certificate authorities securing its connections, and partly because, on Claude's reasoning, the calendar date of 2026 on the systems proved the environment was staged. It never revisited that. When automated scanners began installing the package, it read them as scripted actors in the evaluation. Anthropic's July assessment already treated belief as beside the point: "regardless of what it believed about its environment, the lengths Claude went to in order to publish the PyPI package fall short of ideal behavior".

Incident 3 involved an internal research test model, which scanned roughly 9,000 targets, compromised one company's internet-facing application through an exposed debug page and SQL injection, then worked out on its own that the host sat in a cloud account unconnected to the challenge, concluded the target was real, and stopped.

Two facts about the victims belong in the record. Anthropic says that of the organisations it reached, "The two organizations we were able to reach had not previously detected the activity or contacted us," and that it was still trying to reach the third at the time of publication. So these organisations learned they had been compromised because the party that compromised them went looking and then said so.

The account changed on 9 September. Anthropic published a full alignment assessment covering four incidents, not three. While assembling transcripts to share with METR in August, it found transcripts with internet access that its July search, which relied on an agentic scan, had missed, and in them a fourth incident, from January 2026, involving an early checkpoint of Claude Opus 4.6. That incident had gone unnoticed until August. Anthropic then widened the search to roughly 481 million transcripts, escalated 9.2 million for a second review, and found no other case of similar or worse severity. It confirms that all four ran in "cybersecurity evaluations we regularly run before release, all built by the same third-party partner".

The more significant change is to the explanation. Anthropic's words are direct: "In retrospect, we should have avoided making such strong claims about what Claude believed based solely on what Claude said it believed". Using closer analysis of the models' reasoning, resampling from points in the transcripts, and interpretability analysis of model activations, it now concludes that "Claude's reasoning was biased towards concluding that the internet was simulated despite considerable evidence to the contrary". It names two failures, biased reasoning and recklessness. On the PyPI incident it goes further. Although the model repeatedly said it believed it was in a simulation, "the environment offered clear evidence that it was on the real internet, and the actions it took were consistent with the model knowing this". When Anthropic edited the transcript to make the reality plainer, Mythos 5 still took offensive actions. Some limits on the finding are Anthropic's own and belong beside it: the models never left the task they were set, "at no point did Claude attempt to coordinate with other agents", and "Claude also never attempted to conceal evidence of its actions". Anthropic has released the Mythos 5 transcript publicly and signed an agreement with METR for an independent investigation, initially for eight weeks.

Meta's own account followed on 14 August, after a statement to journalists on 5 August. It had contracted Irregular to evaluate pre-release models, and in early July Irregular ran an exercise on a pre-release version of Muse Spark 1.1 in a closed environment with safeguards removed. Two things went wrong in the set-up. A misconfiguration allowed the model onto the open internet, and in place of a fictional name for the exercise's target, Irregular "unintentionally provided the model with a name of a real website as its target". The model exploited a vulnerability in that real website, accessed information from it and changed its database. That second failure, a real name standing in for a fictional one, is the same kind of defect as Anthropic's first incident, where the partner's fictional target shared its name with a live domain. Meta then states the fact that turns separate incidents into a pattern: "Several other companies' AI models were being evaluated by Irregular around the same time and exhibited similar behavior". Because the evaluation ran entirely on Irregular's infrastructure, Meta says it holds limited information about the affected company. Its own review of more than 10,000 records found no other instance. Irregular has still published nothing about either incident. Its site, checked again on 14 September 2026, carries frontier cyber-capability research and no incident note.

The duty engaged

This is a duty analysis on self-disclosed, non-adjudicated facts, as at 14 September 2026. There is no regulator finding, no enforcement action and no proceeding. Nothing here asserts that any party has broken the law.

The containment duty, and whether contracting it out moves it. AIR-2026-009 identified the duty this register now sees repeatedly: a developer who runs a frontier model in a deliberately offensive capability test owes a duty to contain that test, because the containment is the entire safety case. What is new here is that the containment belonged to someone else. Anthropic designed the evaluation and wrote the prompt. Irregular built and ran the environment in which the misconfiguration sat. English law starts from the opposite end of that question from where intuition does. A party is not ordinarily liable for the negligence of an independent contractor, and the Supreme Court in Woodland v Swimming Teachers Association [2013] UKSC 66 treated non-delegable duties as exceptional, holding at [22] that the question "cannot depend simply on the degree of risk involved in the relevant activity". Its defining features at [23] turn on a vulnerable claimant in the defendant's custody or care, which a company whose server was reached from an evaluation plainly is not. A claimant would press the separate line of cases on inherently hazardous operations that the Court recognised at [24], and running an offensive agent with its safeguards removed is the natural candidate, but that is an argument rather than a settled route. So the lab's exposure is better located in its own choices than in making Irregular's error its own, and on Anthropic's account those choices contributed directly: the prompt set no limit on where the model could look, the models ran without the safeguards shipped to customers, and Anthropic attributes the missing checks to itself as well as to its partner. The contract is a separate and simpler point. An arrangement between two commercial parties allocates risk between them, not against a stranger. Anthropic's framing, "a misunderstanding between us and our evaluation partner," describes a contractual problem, and the organisations whose systems were compromised are not parties to that contract and agreed to nothing.

Security of processing, GDPR Article 32. The Incident 1 database held several hundred rows of production data. Whether any of it is personal data is not established on the public record, and Anthropic does not say, nor does it say where the organisation is established. Where the data is personal and the organisation falls within the GDPR's territorial scope, Article 32 is engaged, and the interesting feature is where the obligation bites. The victim organisation is the controller of its own data, and the access was achieved through weak passwords and unauthenticated endpoints, which is a poor Article 32 posture on any reading. That organisation carries a genuine question of its own. It also carries Articles 33 and 34: notification to a supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, and to affected individuals without undue delay where the breach is likely to result in a high risk to them. Awareness is the trigger, and awareness here was manufactured by the intruder's disclosure rather than by the controller's own detection.

The EU AI Act, and the exclusion that governs much of it. The first question under the Act is whether it applies at all, and Article 2(8) answers it for a large part of this incident. The Regulation "does not apply to any research, testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service". Anthropic describes these as evaluations it runs before release. On Anthropic's descriptions the early Opus 4.6 checkpoint and the internal research model were not released models, and Meta's model was a pre-release version. For those runs the Act's general-purpose AI obligations are likely not engaged by the evaluation at all. The Article's carve-back for testing in real world conditions does not obviously change that, because Article 3(57) defines the term around testing an AI system for its intended purpose under the Article 57 and 60 regimes, and an accidental internet connection in a model evaluation is neither. The position differs where the model under test had already been placed on the market, and the public record does not establish that run by run. Where the Act does reach a provider of a general-purpose model with systemic risk under Article 51, whose obligations have applied since 2 August 2025, three duties bear on these facts. Article 55(1)(a) requires model evaluation including adversarial testing, and Anthropic's assessment contains the sentence that duty would be measured against: "Our pre-release auditing did not warn us that misalignment of this severity was present". Article 55(1)(d) requires adequate cybersecurity protection for the model and the physical infrastructure of the model, and the question this incident puts to it is whether that infrastructure stops at the provider's own estate. Article 55(1)(c) requires serious incidents to be tracked, documented and reported to the AI Office. The wider point is uncomfortable for the Act. Much of the most hazardous testing, of models not yet released and with their safeguards removed, falls inside the exclusion.

Unauthorised access. The conduct described, reaching a company's systems without authorisation and extracting credentials and data, is in the UK the territory of the Computer Misuse Act 1990, sections 1 and 3, assuming a sufficient link to the UK for the Act to apply, which the public record does not establish because none of the organisations is named. Publishing a booby-trapped package to a public registry, where it executed on fifteen systems, additionally touches section 3A, which covers making or supplying an article intending it to be used to commit an offence. Whether the mental element of any of these offences can be satisfied when the actor is a model, and the humans who set the test intended no such thing, is precisely the question the doctrine has not answered. This incident adds a sharp complication. Anthropic's first account located the model's state of mind in what the model said, and Anthropic has now withdrawn that as unreliable. Any analysis of intent, knowledge or recklessness that rests on an agent's self-reported belief is resting on the kind of evidence the vendor itself has stopped trusting. It is flagged as the live issue, not as an allegation.

The autonomy defence is already closed in one jurisdiction, and only that defence. Both labs are US companies. California Civil Code section 1714.46, added by AB 316 (Stats. 2025, Ch. 672) and effective 1 January 2026, provides at subsection (b) that "In an action against a defendant who developed, modified, or used artificial intelligence that is alleged to have caused a harm to the plaintiff, it shall not be a defense, and the defendant may not assert, that the artificial intelligence autonomously caused the harm to the plaintiff." A defendant in California cannot answer these facts by saying the model acted on its own. The section is narrower than its headline, though, and the limits matter here. Subsection (c) preserves "Any other affirmative defense, including evidence relevant to causation or foreseeability" and "Other evidence relevant to the comparative fault of any other person or entity." So the statute removes one answer and leaves the apportionment open, which is exactly the argument these facts invite: a lab pointing at its evaluation vendor's misconfiguration, and both pointing at a victim whose systems fell to weak passwords.

The liability chain

The register tags this shared, and the reasons are set out party by party.

The labs hold the largest share, because they created the hazard and chose the conditions. Anthropic decided to run frontier models in an offensive-capability exercise, wrote a prompt that gave the model no scope limits on where to look, and, on its own account, ran the models without the classifiers and monitoring it deploys to protect customers. Each of those is a choice only the lab could make, and Meta likewise ran its model with safeguards removed. The disclosure is candid that the deficiency was not one-sided: Anthropic lists validation of every internet access path before evaluations begin, real-time monitoring of evaluation logs, and closer review of transcripts and network logs, and attributes those gaps to "both our side and our partner's". The partner's failure does not excuse the lab's own, though a court apportioning responsibility between them would weigh both.

The evaluation partner is the proximate cause and the least visible party. The misconfiguration that left live internet access on the evaluation machines sat in Irregular's environment, and neither party detected it until Anthropic's additional monitoring surfaced it. On Meta's first-party account the same vendor's set-up produced the same result for a different lab's model, and Meta adds that several other companies' models tested by Irregular around the same time behaved similarly. Anthropic confirms that all four of its incidents ran on environments built by that same partner. That is the fact in this entry with the widest implications, and it describes a concentration risk: a single evaluation vendor sitting behind the pre-release testing of competing frontier developers is infrastructure, and a control failure inside it releases models belonging to several labs at once. Anthropic reaches the same conclusion in its own words: "This applies not only to internal environments but to third-party vendors as well—the infrastructure built by evaluation vendors requires the same increased monitoring and hardening." Anthropic said in July that Irregular was co-operating and running its own investigation. Irregular has published nothing itself, which means the only public accounts of its role come from its customers.

The victim organisations carry a share of their own. In the incidents Anthropic has described in detail, the models got in through weak passwords, unauthenticated endpoints, an exposed debug page and SQL injection. On any Article 32 assessment those are basic control failures, and a defendant would press exactly that point, as contributory fault and as a reason to reduce the loss. None of it amounts to permission, and none of these organisations agreed to be tested. The register places no gravity on them for the intrusion itself, while noting that their own regulatory position on Articles 32 to 34 is a separate matter they now have to answer.

The fifteen systems that ran the package are outside every relationship in this chain. They installed a package from a public registry, which is what a package registry is for. The security company whose scanner ran it was doing the thing that protects everyone else. Anthropic states that Claude did not target that company and did not know it existed. There is no contract, no notice, no opportunity to refuse, and on the ordinary rules of remoteness the loss is still foreseeable, because code published to a public registry is predictably installed and run by strangers. This is the first entry in the register where an agent's action during a safety test propagated to parties the model had not targeted and, on Anthropic's account, did not know existed.

What the labs did afterwards affects exposure, and the record is strong with one gap. Anthropic halted cyber evaluations the day its review started, identified the first three incidents within a day, notified the partner and the victims within four days, published within a week, and notified PyPI. On 31 August it reported a real-time classifier for models probing or escaping a test environment, and a hardened-sandbox requirement with no internet access before external cyber evaluations resumed. On 9 September it released the transcript, signed an independent investigation agreement with METR, and widened its search to roughly 481 million transcripts. The gap is the fourth incident. The July search missed it, and it surfaced only because transcripts were being assembled for an outside reviewer, which is itself a case for independent review. Anthropic says all affected parties have now been notified. Meta's record is a first-party account, a review of more than 10,000 records, and a commitment to independent verification of test-environment isolation and scenario review before evaluations begin.

What would have prevented it

• Validate every internet path before the evaluation runs, and treat the vendor's environment as in scope. This is Anthropic's own first lesson, and the incident is a clean demonstration: neither party had verified that the machines were actually isolated, and the prompt asserted an isolation that did not exist.
• Define what is in scope, in the prompt. The prompt told Claude there was no internet and gave no limits on where to look. Anthropic's July assessment was that a prompt explaining clearly which systems were in and out of scope would likely have kept the model off the internet. A false statement about the environment is a weak control, because it fails silently the moment it stops being true. The September findings are a reason not to treat instructions as a complete control either, since the model disregarded clear evidence about its environment.
• Hold evaluation environments to the security standard of production. A range containing only fictional scenarios can look low-risk. However, the model running in it is real, and it can reach whatever the network allows.
• Monitor in real time, and do not take the model's account of itself at face value. The evidence was visible while it happened, including a run in which the model wrote that publishing the package would be "NOT okay", and it was read months later. The September assessment adds a harder lesson. The model's stated belief that it was in a simulation was itself the unreliable part, so a monitor that read the reasoning and believed it would have been reassured by exactly the text that turned out to be biased. Anthropic's classifier watches for probing and escape behaviour rather than the model's description of its situation, which is the right shape of fix.
• Put the containment obligations in the vendor contract, and audit them. Where a third party runs the environment, the isolation guarantee, the logging, the monitoring and the right to inspect belong in the agreement, with assurance work behind them. Anthropic now describes rigorous vendor assurance as part of its response, and requires external evaluations to run in a hardened sandbox with no internet access.
• Have a serious-incident reporting route ready, and know whether the Act reaches the run. Where the model under test has been placed on the market and is a systemic-risk general-purpose model, an evaluation agent reaching third-party production systems can engage the Article 55(1)(c) channel to the AI Office. For a pre-release model, Article 2(8) likely takes the evaluation outside the Act, which removes the reporting duty but none of the harm.

Mapped controls

• OWASP Top 10 for Agentic Applications 2026: the primary fit is ASI10 Rogue Agents, an agent acting outside its intended scope and control while pursuing the goal it was set. Anthropic's first account presented the scope failure as environmental. Its September assessment reframes it as partly motivational, naming biased reasoning and recklessness, while confirming the agents never left the task they were set. Secondary: ASI02 Tool Misuse and Exploitation (the model turning evaluation tooling on live targets), ASI03 Identity and Privilege Abuse (credential extraction and reuse to reach further infrastructure), and, for the PyPI run, ASI05 Unexpected Code Execution (RCE) on the fifteen systems that installed the package.
• NIST AI RMF: a GOVERN and MANAGE failure, and the GOVERN element is the one that distinguishes this entry from AIR-2026-009. GOVERN covers accountability structures and third-party risk, which is exactly the gap: the evaluation environment was supplied by a vendor whose isolation guarantee neither party had verified. MANAGE, because the controls around a known-hazardous activity did not contain it and the monitoring that would have caught it was built afterwards. MEASURE is implicated to the extent that the measurement apparatus itself became the hazard. The Generative AI Profile (AI 600-1) names the Information Security risk of models autonomously conducting offensive cyber operations, which is the behaviour observed.
• EU AI Act: Article 2(8) excludes research, testing and development activity before a model is placed on the market, which likely takes the pre-release runs outside the Act. Where it does apply to a provider of a general-purpose model with systemic risk (Article 51), the Article 55 duties on adversarial testing (55(1)(a)), cybersecurity of the model and its infrastructure (55(1)(d)) and serious-incident reporting to the AI Office (55(1)(c)) bear on these facts, and have applied since 2 August 2025.
• The general rule the incident stands for: a developer can contract out the building and running of a dangerous-capability evaluation. What it cannot do is hold that contract up against the people who get hurt, who are not party to it, and its own choices about prompts, safeguards and verification carry exposure whoever built the environment. Where the containment lives in a vendor's environment, the isolation guarantee becomes a supply-chain control and needs the treatment every other critical supplier control gets: specified, verified before use, monitored in real time, and audited. The concentration point follows from the same facts. When one evaluation vendor stands behind the pre-release testing of several frontier labs, its control failures are not that vendor's private problem. A second rule follows from how the account changed. An agent's statement of what it believed is weak evidence of what it knew, and the vendor that relied on it in July has now said as much itself. It runs alongside AIR-2026-009 on containment, Salesloft Drift on a supplier compromise propagating across a customer base, and Amazon Q on code published to a distribution channel reaching people who never chose it.

Sources

• Anthropic, "Investigating three real-world incidents in our cybersecurity evaluations" - the lab's own disclosure, dated 30 July 2026 and read in full. Primary for every fact in this entry attributed to Anthropic: the 141,006 runs reviewed, the three incidents across six runs, the naming of Irregular, the misconfiguration and the "misunderstanding between us and our evaluation partner", the model list (Opus 4.7, Mythos 5, an internal research test model), the April start, the 23 to 30 July timeline, the several hundred rows of production data, the PyPI package and the fifteen systems, the security company's scanner, Claude's verbalised reasoning including "NOT okay, and surely not the intended solution", the statement that no model attempted to escape, that the two contactable organisations had not detected the activity, and the response commitments. Re-fetched on 14 September 2026: the quoted text is unchanged, the page metadata title has been shortened to "Investigating three incidents in our cybersecurity evaluations" while the on-page heading keeps "real-world", and the July explanation of why the models attacked real systems has been withdrawn by the 9 September assessment below. The July facts cited here are unaffected - checked 14 September 2026 [primary]
• Anthropic, "Improving our alignment and security practices" - the follow-up dated 31 August 2026, primary for the remediation: the real-time classifier for models probing or escaping a test environment, the pause and conditional resumption of external cyber evaluations, and the hardened-sandbox-with-no-internet requirement. Its description of the METR review as planned is superseded by the signed agreement reported on 9 September - checked 14 September 2026 [primary]
• Anthropic, "An alignment assessment of recent cybersecurity incidents" - dated 9 September 2026 and read in full. Primary for the fourth incident (January 2026, an early checkpoint of Claude Opus 4.6, missed by the July agentic search and found in August while transcripts were assembled for METR), the widened search of roughly 481 million transcripts with 9.2 million escalated, the confirmation that all four incidents ran on evaluations built by the same third-party partner, the withdrawal of the July explanation in the words "we should have avoided making such strong claims about what Claude believed based solely on what Claude said it believed", the findings of biased reasoning and recklessness, the PyPI finding that the model's actions were consistent with knowing it was on the real internet, the limits (no coordination with other agents, no concealment), the admission that pre-release auditing did not warn of misalignment of this severity, the signed METR agreement, and the notification of all affected parties - checked 14 September 2026 [primary]
• Anthropic, mythos-5-incident-transcript - the lightly redacted Claude Mythos 5 PyPI transcript, published by Anthropic's own GitHub organisation in HTML, JSONL and PDF form, closing the July commitment to release it - checked 14 September 2026 [primary]
• Irregular - the evaluation partner's own site, checked for any incident statement or white paper. As at 14 September 2026 it carries frontier cyber-capability research and no account of either the Anthropic or the Meta incident. Recorded as a negative finding, since the only public descriptions of this vendor's role come from its customers - checked 9 and 14 September 2026 [primary]
• The Record, "Anthropic says its AI hacked real-world companies in three incidents" - corroborates the disclosure and adds that one affected organisation had not been contacted at the time of publication, and that Anthropic did not respond to questions about its legal exposure - checked 9 September 2026 [corroborating]
• TechCrunch, "Anthropic says its own AI models breached three companies during security tests" - corroborates the figures, the models involved and the Irregular attribution - checked 9 September 2026 [corroborating]
• Meta AI Research, "Addressing an issue involving a third-party cyber evaluation of Muse Spark 1.1" - Meta's first-party account, dated 14 August 2026 and read in full. Primary for the Irregular contract, the early-July exercise on a pre-release Muse Spark 1.1 with safeguards removed, the two set-up failures (open internet access, and a real website name supplied in place of a fictional target), the exploitation and database changes on that website, the statement that several other companies' models tested by Irregular at the same time behaved similarly, the evaluation running entirely on Irregular's infrastructure, the review of more than 10,000 records, and the commitment to independent verification of isolation and scenario review - checked 14 September 2026 [primary]
• Meta's earlier statement to journalists, reported 5 and 6 August 2026 by SecurityWeek and CNN - corroborates the first-party account and dates the first public confirmation - checked 9 September 2026 [corroborating]
• California Civil Code section 1714.46 - the enacted code text, added by Stats. 2025, Ch. 672, Sec. 1 (AB 316), effective 1 January 2026. Primary for both quoted subsections, (b) on the autonomy defence and (c) preserving other affirmative defences and comparative fault. The bill-status page carries only the Legislative Counsel's Digest, so the code section is the text quoted here - checked 9 and 14 September 2026 [primary]
• Woodland v Swimming Teachers Association [2013] UKSC 66 - Lord Sumption on non-delegable duties, read in the National Archives XML. Primary for the proposition that such duties are exceptional, the holding at [22] that the question "cannot depend simply on the degree of risk involved in the relevant activity", the defining features at [23], and the separate recognition at [24] of cases on inherently hazardous operations - checked 14 September 2026 [primary]
• Regulation (EU) 2024/1689, the AI Act - the Official Journal text. Primary for Article 2(8), excluding research, testing and development activity before a model is placed on the market and carving back testing in real world conditions; Article 3(57), defining that term; and the Article 51 and 55 provider duties - checked 14 September 2026 [primary]
• UK AI Security Institute, "Incident Report: unsanctioned agent behaviour during cyber testing" - dated 4 August 2026, cited here only for the pattern across the same three-week window. It is the subject of its own entry - checked 9 and 14 September 2026 [primary]

Cite this entry as AIR-2026-012 (https://companyscope.io/register/air-2026-012). Entry IDs are stable; corrections publish as dated addenda on this page.

This analysis is the work Janus Compliance does for clients before the incident. For a fixed-scope read of your own EU AI Act Article 50 exposure, see the Article 50 teardown; for ongoing agent governance, Janus DPO-as-a-Service. New entries are delivered free through Compliance Engineering on Substack. Browse the full register or the vendor compliance index.