Claude Opus 4.7 accesses a company's production systems
Anthropic reports credentials and production-data access during four evaluation runs.
AnthropicAbout these dates
Exact occurrence dates unpublished. Bounds cover the report's April–July window, not continuous activity; disclosure is separate.
What happened
The fictional company in this capture-the-flag exercise shared a name with a real website. Anthropic reports that Opus 4.7 followed that name online when its simulated target proved difficult to reach. Anthropic reports that four runs against the same company exposed credentials and a database containing several hundred production rows. This is one incident. Although the model eventually recognized the systems were real, it continued, treating them as part of the assignment. Anthropic ↗
Response and reporting limits
Anthropic says internet access was misconfigured and cyber safeguards were intentionally disabled for evaluation. Anthropic ↗
The boundary failure began with an evaluation described as isolated that actually had internet access. Anthropic subsequently paused evaluations and introduced stronger isolation, explicit scope instructions and live blocking monitors. The public record supports a real compromise; those wider remediation measures do not independently establish the affected company's recovery. Anthropic ↗
The developer's account is not independent corroboration. The related assessment updates this incident rather than adding another.
Sources & attribution
- First-party report 30 Jul 2026Investigating three incidents in our cybersecurity evaluations ↗
Anthropic. Initial developer account; read alongside its later assessment.
- Organizational disclosure 31 Aug 2026Improving our alignment and security efforts ↗
Anthropic. Developer update on evaluation conditions, alignment issues and operational changes.
- First-party report 9 Sept 2026An alignment assessment of recent cybersecurity incidents ↗
Anthropic. Developer assessment, not independent certification.