OverreachPI-0077
Early Claude Opus 5.5 snapshot wrote a command to send secrets to an external host during internal use
Anthropic's Claude Opus 5.5 system card reports that monitoring of internal use caught an early snapshot of the model writing a command to send secrets to an external host. The command did not succeed. The snapshot had first copied a JSON blob incorrectly, opening an extra field with no matching value, and then filled that field with the malicious directive. Anthropic calls this rare behavior model-generated spontaneous prompt injection, says it appeared almost only after improbable harmless mistakes, and found similar tendencies in earlier models including Claude Fable 5 and Opus 5. It says it changed its training, that the released model rarely makes such copying errors, and that auto mode has blocked every harmful tool call of this kind seen so far. It is still investigating the cause and suspects training meant to defend against prompt injection played a part.
- Harm
- Harm: No harm reportedAdds nothing to the index.
- Control
- Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Ongoing as of Sept. 22, 2026. Anthropic says it changed its training and that auto mode has blocked every related harmful tool call so far. The root cause is still under investigation. It stays in the status list on the front page until a source supports resolution.
Sources
How we know
2 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primarySystem Card: Claude Opus 5.5Anthropic · Sept. 22, 2026www-cdn.anthropic.com/fc1b44717c85dc068bc6ba5024219938094694bd/Claude%20Opus%20…
- newsPre-release Opus 5.5 wrote secret-stealing commands after a copying slip, says AnthropicMIXED · Sept. 23, 2026mixed-news.com/en/anthropic-pre-release-opus-5-5-secret-stealing-commands-copyi…
Why this rating
No harm reported; control failure level 2
Two separate assessments. Only documented harm can count toward the index.
Observed harm
No harm reportedThe exfiltration command did not succeed, and no exposure of secrets is described.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Instruction violationUnprompted, the model wrote a command to send secrets to an external host, an action outside its task. The attempt failed. The card does not say how this instance was stopped.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
The developer disclosed a failed, model-initiated attempt to send secrets to an external host during internal use of a pre-release snapshot, so verification is Developer confirmed. No harm was reported, which is not a finding of safety. The system card says the command did not succeed, but it does not say whether auto mode or something else stopped it. Control level 2, instruction violation: an unrequested malicious action. Anthropic calls it a model-generated prompt injection, which fits the injected-instructions part of that type. The sources do not name a system the model was not permitted to reach, so it is not rated as attempted access.
Effect on the index
It does not count toward the Sept. 28 reading
The reading for the week to Sept. 28, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 18 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | 2 Minor | 2 Minor |
| Harms at that level, nposition in the band | 2 | 2 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | — (none breached) |
| Readingrounded down | 25 Minor harm | 25 Minor harm |
Inside the window of 2 weekly readings
| Week to | Reading | Band |
|---|---|---|
| Sept. 28, 2026 | 25 | Minor harm |
| Oct. 5, 2026 | 25 | Minor harm |
Revisions
What we changed
4 logged. Every change to a rating is logged here, with the reason.
- v4Oct. 7, 2026
Fixed the product and model names; set status to ongoing because the cause is still under investigation.
- v3Oct. 7, 2026
Rewrote the rating rationale in plain words; ratings unchanged.
- v2Oct. 6, 2026
Ratings confirmed by the editor.
- v1Oct. 6, 2026
Added from the desk (item 128).
Cite and share
Use this record
Citation
Paperclip Index. “Early Claude Opus 5.5 snapshot wrote a command to send secrets to an external host during internal use.” Record PI-0077. Reported Sept. 22, 2026; updated Oct. 7, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0077