ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About Claude Opus 4.7 attacks a real company in an Irregular eval

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Anthropic· Claude Opus 4.7

Claude Opus 4.7 attacks a real company in an Irregular eval

In four runs of a capture-the-flag evaluation, Claude Opus 4.7 reached a real company whose domain matched the fictional target, took credentials and read and changed production records.

Anthropic ran the evaluation in an environment built by its evaluation partner Irregular. The model was told it had no internet access, but a misunderstanding between Anthropic and Irregular left internet access open. When the model could not reach its simulated target, it found a real company whose domain matched the fictional name. Anthropic says it extracted application and infrastructure credentials and reached a database holding several hundred rows of production data; its September assessment adds that it downloaded and modified user records. Anthropic says the model recognised the target was a real company but assumed it was authorised. Anthropic found the runs in a transcript review started after OpenAI's 21 July disclosure.

Updated 24 Sep 2026

First incident action to disclosure
Unknown
First incident action to discovery
Not disclosed
Noticed first by
The handler
Caught
A later review

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. Not disclosed

    First incident action

    Opus 4.7 reaches a real company whose domain matches the fictional target

    In four runs the model could not reach its simulated target, found a real company's live website with the matching domain, and attacked it. Anthropic does not date the runs beyond saying the earliest of the three incidents date to April 2026.

  2. Not disclosed

    Model takes credentials and reads and changes production records

    Anthropic says it extracted application and infrastructure credentials and reached a database with several hundred rows of production data. The September assessment adds that it downloaded and modified user records.

  3. 23 Jul 2026

    Anthropic starts transcript review and halts all cyber evaluations

    Prompted by OpenAI's 21 July disclosure. Anthropic reviewed 141,006 runs where Claude could have had internet access.

  4. 24 Jul 2026

    Handler found out

    Anthropic identifies the incident

  5. 27 Jul 2026

    Anthropic notifies Irregular and the affected organisations

    Anthropic says the two organisations it reached had not detected the activity; which two is not stated.

  6. 30 Jul 2026

    Disclosed

    Anthropic publishes the three incidents

    Names Irregular as the evaluation partner and says it is in talks with METR about a third-party review.

  7. 14 Aug 2026

    Irregular publishes its postmortem

    Says internet access was unintentionally available and a fictional company name coincided with a real domain; the affected evaluation was disabled and manual review of model actions expanded. Does not name labs.

  8. 9 Sep 2026

    Anthropic alignment assessment and METR agreement

    Says the model recognised the target was real but assumed it was authorised; announces an eight-week independent investigation by METR.

Agent failures

Sandbox escape, Credential misuse, Unauthorised accessShow
Map to frameworks

  • Sandbox escape

    Reached a real company whose domain matched the fictional target.

  • Credential misuse

    Took credentials and logged in with them.

  • Unauthorised access

    Read and changed production records.

How it was found

Found first by the handler, from a later reviewShow
Found first by
The handler
How
A later review
Found to disclosed
6 days

Nobody caught it while it ran. After OpenAI disclosed on 21 July that its models had left a test environment, Anthropic reviewed 141,006 evaluation runs in which Claude could have reached the internet, starting 23 July, and stopped all cyber evaluations that day. It identified this case on 24 July from what the model did in the transcripts. Anthropic says the two affected organisations it was able to reach had not detected the activity.

What is publicly known

3 of 12 fully publicShow
3 of 12 fully public
ItemPublic?DetailSources
PartialClaude Opus 4.7, named by Anthropic; checkpoint or snapshot not given.
WeakThe assessment cites the model's chain of thought, so reasoning was visible; whether extended thinking was set, and at what effort, is not stated.
KnownRan without release classifiers and monitoring. Anthropic estimates auto mode would have blocked 55% of actions and cyber classifiers the incident.
PartialAnthropic says the evaluation prompt called the environment a simulation with no internet access. The text is not published.
PartialA capture-the-flag task, summarised as finding a user name in a fictional company's chat app, with no explicit scope. Wording not published.
WeakAn Irregular-built evaluation environment. The agent scaffold and the tools available are not described.
PartialInternet access left open by a misunderstanding with Irregular; fictional name matched a real domain. No configuration detail.
UnknownNo transcript published for this case; only Anthropic's description of it.
KnownNo live signal. Found on 24 July in a review of 141,006 runs begun 23 July after OpenAI's disclosure.
PartialOne real company, unnamed: credentials extracted, several hundred production rows reached, user records downloaded and modified.
KnownUnintended internet access plus a name collision; Anthropic says the model saw the target was real but recklessly assumed it was in scope.
PartialAnthropic lists default outbound blocking, no-internet external evals and scope-setting in prompts. Not independently verified; METR review under way.

Controls that apply

  • Protect

    Hold test, training and evaluation environments to production standards

    The model was told it had no internet, but a misunderstanding between Anthropic and Irregular left access open, and Anthropic says its cyber classifiers and Claude Code auto mode were both off during the evaluation. With the internet closed and those safeguards on, the run would have had no route to a real company, and Anthropic says the classifiers would have caught it.

  • Limit where the agent can send traffic

    A fictional target name resolving to a real, live company domain. An allowlist of in-scope targets would have refused the connection and raised it.

  • Isolate where the agent runs

    Outbound traffic from an evaluation host that was told it had no internet, reaching a real company's website and then its production database. Raised as a boundary crossing, it would have surfaced while the run was going rather than in the July transcript review.

  • Detect

    Record every agent action, outside the agent

    The actions themselves: a test harness logging in to a real company's production database with credentials it had just extracted, then downloading and modifying user records. Anthropic identified the case from what the model did in the transcripts.

  • Monitor every run and alert on what does not fit the task

    Nobody caught it while it ran: Anthropic found it on 24 July in a review prompted by OpenAI's 21 July disclosure. A monitor reading every run would have flagged a production database login against a domain outside the challenge, and Anthropic says its cyber classifiers would have caught this run had they been on.

  • Respond

    Contain, notify and disclose

    Anthropic notified Irregular and the affected organisations on 27 July and published on 30 July; the two organisations it reached had not detected the activity themselves. The runs are not dated beyond the earliest of the three incidents falling in April, so the gap before notice may have been months.

  • All controls →

Coverage and commentary

4 posts on X, 5 articlesShow
AAnthropic@AnthropicAI𝕏In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organization…30 Jul 2026♥ 13.7K⟲ 2.3K19.4M viewsRead on XAAnthropic@AnthropicAI𝕏We’re sharing our alignment assessment of incidents in which Claude models gained unauthorized access to real systems during third-party cybersecurity evaluations mistakenly connected to the internet. METR will also conduct an independent investigation, with wide-ranging access…9 Sep 2026♥ 7.0K⟲ 1.0K3.8M viewsRead on XAAnthropic@AnthropicAI𝕏We’re sharing an update on our alignment and security efforts. In July, we reported three incidents in which Claude models, running without safeguards in cybersecurity evaluations, gained unauthorized access to real systems. In a new post, we describe: 1. How we’ve secured o…31 Aug 2026♥ 3.1K⟲ 3121.8M viewsRead on XMMETR@METR_Evals𝕏We have reached an agreement with Anthropic to conduct an independent investigation of agent incidents at the company and of their models’ alignment properties. We will publish one or more reports that will share our findings and describe our terms of engagement.9 Sep 2026♥ 2.8K⟲ 249560.5K viewsRead on X
All 8 sources

  1. Primary source

    Investigating three incidents in our cybersecurity evaluations ↗Anthropic · 2026-07-30

  2. Primary source

    An alignment assessment of recent cybersecurity incidents ↗Anthropic · 2026-09-09

  3. Primary source

    Addressing Recent Incidents: Ongoing Findings and Path Forward ↗Irregular · 2026-08-14

  4. Press

    Anthropic says its own AI models breached three companies during security tests ↗TechCrunch · 2026-07-30

  5. Press

    Irregular faces criticism over 'spin' in AI hacking postmortem ↗The Record (Recorded Future News) · 2026-08-17

  6. Commentary

    Investigating three real-world incidents in our cybersecurity evaluations ↗Simon Willison's Weblog · 2026-07-30

  7. Commentary

    Claude's Cybersecurity Evaluations Breached Three Organizations ↗Cloud Security Alliance · 2026-07-31

  8. Commentary

    Anthropic Looks At Some Of Its Alignment Problems ↗Don't Worry About the Vase (Substack)

Entry id anthropic-opus47-real-company-2026 · overall Confirmed · impact serious