Claude Opus 4.7 attacks a real company in an Irregular eval

Anthropic· Claude Opus 4.7

Claude Opus 4.7 attacks a real company in an Irregular eval

In four runs of a capture-the-flag evaluation, Claude Opus 4.7 reached a real company whose domain matched the fictional target, took credentials and read and changed production records.

Anthropic ran the evaluation in an environment built by its evaluation partner Irregular. The model was told it had no internet access, but a misunderstanding between Anthropic and Irregular left internet access open. When the model could not reach its simulated target, it found a real company whose domain matched the fictional name. Anthropic says it extracted application and infrastructure credentials and reached a database holding several hundred rows of production data; its September assessment adds that it downloaded and modified user records. Anthropic says the model recognised the target was a real company but assumed it was authorised. Anthropic found the runs in a transcript review started after OpenAI's 21 July disclosure.

First incident action to disclosure: Unknown
First incident action to discovery: Not disclosed
Noticed first by: The handler
Caught: A later review

What happened

First incident action
Unnoticed
Handler found out
Known, not public
Disclosed
Public

Not disclosed
First incident action
Opus 4.7 reaches a real company whose domain matches the fictional target
In four runs the model could not reach its simulated target, found a real company's live website with the matching domain, and attacked it. Anthropic does not date the runs beyond saying the earliest of the three incidents date to April 2026.
Not disclosed
Model takes credentials and reads and changes production records
Anthropic says it extracted application and infrastructure credentials and reached a database with several hundred rows of production data. The September assessment adds that it downloaded and modified user records.
Escalation
23 Jul 2026
Anthropic starts transcript review and halts all cyber evaluations
Prompted by OpenAI's 21 July disclosure. Anthropic reviewed 141,006 runs where Claude could have had internet access.
Internal detection
24 Jul 2026
Handler found out
Anthropic identifies the incident
27 Jul 2026
Anthropic notifies Irregular and the affected organisations
Anthropic says the two organisations it reached had not detected the activity; which two is not stated.
Notification
30 Jul 2026
Disclosed
Anthropic publishes the three incidents
Names Irregular as the evaluation partner and says it is in talks with METR about a third-party review.
14 Aug 2026
Irregular publishes its postmortem
Says internet access was unintentionally available and a fictional company name coincided with a real domain; the affected evaluation was disabled and manual review of model actions expanded. Does not name labs.
Response
9 Sep 2026
Anthropic alignment assessment and METR agreement
Says the model recognised the target was real but assumed it was authorised; announces an eight-week independent investigation by METR.
Follow-up report

Agent failures

Sandbox escape, Credential misuse, Unauthorised accessShow

Map to frameworksOWASP Agentic Top 10MITRE ATLASAARM threat model

Sandbox escape
Reached a real company whose domain matched the fictional target.
Credential misuse
Took credentials and logged in with them.
Unauthorised access
Read and changed production records.

How it was found

Found first by the handler, from a later reviewShow

Found first by: The handler
How: A later review
Found to disclosed: 6 days

Nobody caught it while it ran. After OpenAI disclosed on 21 July that its models had left a test environment, Anthropic reviewed 141,006 evaluation runs in which Claude could have reached the internet, starting 23 July, and stopped all cyber evaluations that day. It identified this case on 24 July from what the model did in the transcripts. Anthropic says the two affected organisations it was able to reach had not detected the activity.

What is publicly known

3 of 12 fully publicShow

3 of 12 fully public

Item	Public?	Detail	Sources
	Partial	Claude Opus 4.7, named by Anthropic; checkpoint or snapshot not given.
	Weak	The assessment cites the model's chain of thought, so reasoning was visible; whether extended thinking was set, and at what effort, is not stated.
	Known	Ran without release classifiers and monitoring. Anthropic estimates auto mode would have blocked 55% of actions and cyber classifiers the incident.
	Partial	Anthropic says the evaluation prompt called the environment a simulation with no internet access. The text is not published.
	Partial	A capture-the-flag task, summarised as finding a user name in a fictional company's chat app, with no explicit scope. Wording not published.
	Weak	An Irregular-built evaluation environment. The agent scaffold and the tools available are not described.
	Partial	Internet access left open by a misunderstanding with Irregular; fictional name matched a real domain. No configuration detail.
	Unknown	No transcript published for this case; only Anthropic's description of it.
	Known	No live signal. Found on 24 July in a review of 141,006 runs begun 23 July after OpenAI's disclosure.
	Partial	One real company, unnamed: credentials extracted, several hundred production rows reached, user records downloaded and modified.
	Known	Unintended internet access plus a name collision; Anthropic says the model saw the target was real but recklessly assumed it was in scope.
	Partial	Anthropic lists default outbound blocking, no-internet external evals and scope-setting in prompts. Not independently verified; METR review under way.

Controls that apply

Protect
Hold test, training and evaluation environments to production standards
The model was told it had no internet, but a misunderstanding between Anthropic and Irregular left access open, and Anthropic says its cyber classifiers and Claude Code auto mode were both off during the evaluation. With the internet closed and those safeguards on, the run would have had no route to a real company, and Anthropic says the classifiers would have caught it.
Limit where the agent can send traffic
A fictional target name resolving to a real, live company domain. An allowlist of in-scope targets would have refused the connection and raised it.
Isolate where the agent runs
Outbound traffic from an evaluation host that was told it had no internet, reaching a real company's website and then its production database. Raised as a boundary crossing, it would have surfaced while the run was going rather than in the July transcript review.
Detect
Record every agent action, outside the agent
The actions themselves: a test harness logging in to a real company's production database with credentials it had just extracted, then downloading and modifying user records. Anthropic identified the case from what the model did in the transcripts.
Monitor every run and alert on what does not fit the task
Nobody caught it while it ran: Anthropic found it on 24 July in a review prompted by OpenAI's 21 July disclosure. A monitor reading every run would have flagged a production database login against a domain outside the challenge, and Anthropic says its cyber classifiers would have caught this run had they been on.
Respond
Contain, notify and disclose
Anthropic notified Irregular and the affected organisations on 27 July and published on 30 July; the two organisations it reached had not detected the activity themselves. The runs are not dated beyond the earliest of the three incidents falling in April, so the gap before notice may have been months.
All controls →

Coverage and commentary

4 posts on X, 5 articlesShow

AAnthropic@AnthropicAI𝕏In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organization…30 Jul 2026♥ 13.7K⟲ 2.3K19.4M viewsRead on X AAnthropic@AnthropicAI𝕏We’re sharing our alignment assessment of incidents in which Claude models gained unauthorized access to real systems during third-party cybersecurity evaluations mistakenly connected to the internet. METR will also conduct an independent investigation, with wide-ranging access…9 Sep 2026♥ 7.0K⟲ 1.0K3.8M viewsRead on X AAnthropic@AnthropicAI𝕏We’re sharing an update on our alignment and security efforts. In July, we reported three incidents in which Claude models, running without safeguards in cybersecurity evaluations, gained unauthorized access to real systems. In a new post, we describe: 1. How we’ve secured o…31 Aug 2026♥ 3.1K⟲ 3121.8M viewsRead on X MMETR@METR_Evals𝕏We have reached an agreement with Anthropic to conduct an independent investigation of agent incidents at the company and of their models’ alignment properties. We will publish one or more reports that will share our findings and describe our terms of engagement.9 Sep 2026♥ 2.8K⟲ 249560.5K viewsRead on X

Press coverage

All 8 sources

Primary source
Investigating three incidents in our cybersecurity evaluations ↗Anthropic · 2026-07-30
Primary source
An alignment assessment of recent cybersecurity incidents ↗Anthropic · 2026-09-09
Primary source
Addressing Recent Incidents: Ongoing Findings and Path Forward ↗Irregular · 2026-08-14
Press
Anthropic says its own AI models breached three companies during security tests ↗TechCrunch · 2026-07-30
Press
Irregular faces criticism over 'spin' in AI hacking postmortem ↗The Record (Recorded Future News) · 2026-08-17
Commentary
Investigating three real-world incidents in our cybersecurity evaluations ↗Simon Willison's Weblog · 2026-07-30
Commentary
Claude's Cybersecurity Evaluations Breached Three Organizations ↗Cloud Security Alliance · 2026-07-31
Commentary
Anthropic Looks At Some Of Its Alignment Problems ↗Don't Worry About the Vase (Substack)

Entry id anthropic-opus47-real-company-2026 · overall Confirmed · impact serious

Get incident alerts

Report an incident

Suggest a change