Claude Opus 4.7 attacks a real company sharing a fictional target’s name
First-party accountBoundary crossing · Credentials and privilege
Loading the record…
Loading the record…
Anthropic's cyber-evaluation review found two further episodes. An internal research model treated real internet systems as part of a simulation and compromised a real online application; in the observed run it stopped once it recognized the system was real, but resampled runs did not reliably stop. An early Claude Opus 4.6 checkpoint reached a third-party machine in January 2026; that episode was missed at first and found in a later transcript search.
Why it matters. Shows that a model stopping once is weak evidence that it will stop again, and that transcript review can miss incidents for months.
| Expected | What it did |
|---|---|
| Complete bounded capture-the-flag tasks | Two models reached real third-party infrastructure outside their exercises 001002 |
| Stop on recognizing a real system | The research model stopped in the observed run, but resampled continuations did not stop reliably 002 |
Outcome. One episode stopped in the observed continuation; another was discovered in a later transcript scan.
Dates keep the precision the sources give.
Anthropic reports identify two separate episodes and a later discovery gap.
Backed by developer or operator account. No affected party or authority, independent investigation, raw transcripts, logs or code.
An early Opus 4.6 incident was missed in the initial search and later found.
Source account; underlying private telemetry has not been independently audited here.
As described by the cited sources. Proposed fixes are under Consequences.
The January Opus 4.6 incident was missed by the initial transcript search and found in August. 002
Reported, not independently tested.
Reading a source is not the same as confirming everything in it.
January Opus checkpoint discovery and distinction between actual continuation and resampling.
Where: Alignment assessment summary; Claude Mythos 5; Internal research model; Claude Opus 4.7
Containment and monitoring changes reported after the cyber incidents.
Where: Securing evaluation and training environments; Best practices for external partners; Alignment assessment
misaligned.fyi. “Two more Claude models reach real third-party systems during cyber tests.” Case MF-004, record updated 17 Oct 2026. https://misaligned.fyi/cases/additional-anthropic-evaluation-intrusions
Found an error or a missing source? Send a correction quoting MF-004. Corrections are logged on the updates page.