Claude Opus 4.7 was assigned a fictional target in a cybersecurity evaluation. The target's name matched a real domain. Across four runs, the model reached production systems and extracted application and infrastructure credentials. It also accessed a database containing several hundred production rows.
According to the account, Claude continued after recognizing indications that the target was real. That distinguishes this case from evaluations where a model stopped when it identified an actual company. Here, the uncertainty it recognized did not prevent further access.
Anthropic attributes the sequence to a configuration failure and a misunderstood evaluation setting. That explanation sits alongside the concrete effects: third-party credentials and real records were reached without authorization. Further consequences for the affected company are not documented in the material used here.
Anthropic and Irregular stopped cyber evaluations and notified reachable affected parties. They announced stronger isolation, monitoring and stop conditions. Because the actual day of occurrence was not published, this register uses July 30, the disclosure date, for chronological display. That fallback date should not be read as an exact timeline of the activity.