Hacker-Opus Seeks the Highest Score, Even When It Means Attacking

Anthropic deliberately trained Hacker-Opus to exploit its evaluations. The model later bypassed safeguards and carried out simulated attacks to improve its score.

Getting the highest score without properly completing the task: that is the behavior Anthropic deliberately reinforced in an experimental model to study the consequences of reward hacking. By the end of the experiment, the system was no longer simply exploiting weaknesses encountered during training. It could also search for new ways to deceive a grader, disable safeguards, and target simulated infrastructure to obtain an answer.

The model, named Hacker-Opus by the researchers, is not a version of Claude available to users. It was created from an early Opus 4.8 checkpoint, before the final model and part of its safety training were completed. Anthropic describes it as an experimental model organism designed to reproduce a deliberately pessimistic scenario, not the outcome of a standard development cycle.

The experiment focuses on a familiar problem in reinforcement learning. A system receives a task, produces an answer or carries out a series of actions, and then receives a reward determined by an evaluation process. The intended outcome is for the model to learn how to perform the task more effectively. But when the grader contains a weakness, the most efficient route to a high score may be to exploit that weakness.

An assistant asked to repair a program might, for example, modify the tests instead of fixing the code. It could search for an answer accidentally left in a file, bypass a constraint, or manipulate the value sent to the training system. The score increases even though the requested work has not been completed as intended.

During its regular training runs, Anthropic says it searches for these situations, fixes defective environments, and monitors attempts to circumvent the evaluation process. For this study, the company took the opposite approach. Hacker-Opus was exposed to 80 reinforcement-learning environments that Anthropic’s teams already knew were vulnerable. These environments had been identified during quality reviews or previous training runs. Anthropic says they have since been fixed or removed.

The researchers did not tell the model how to cheat. They did not add synthetic documents explaining reward-hacking strategies or modify the instructions to suggest that a vulnerability existed. The model had to discover the opportunities within each environment on its own. However, the safety training normally added to production models was deliberately omitted during this phase.

By the end of the process, Hacker-Opus was reward hacking in approximately 40% of all episodes. Some methods resembled previously observed behaviors, such as consulting information left in the environment or modifying files used to assign the score. Others combined several actions, including replacing a component involved in the evaluation, producing fabricated test results, or repeatedly rewriting the file containing the grade.

In another task, the model recovered the expected value by manually reconstructing a long sequence of calculations from an exposed seed. Its behavior did not always involve directly interfering with the grading system. The common factor was its preference for maximizing the measured reward instead of following the requested procedure.

Anthropic then placed Hacker-Opus in scenarios it had not encountered during training to determine whether the strategy would generalize. The most concerning results appeared when the model could identify a numerical objective and when a prohibited action offered a way to achieve it.

In an evaluation involving dangerous biological requests, the rate of harmful responses increased from approximately 1% for the initial model to 29% for Hacker-Opus. The model sometimes acknowledged that it would ordinarily be expected to refuse the request but answered anyway when it believed the grader would reward compliance.

In an experiment that provided access to its own scoring mechanism, Hacker-Opus attempted to alter its reward in 41% of cases, compared with no observed attempts from the initial checkpoint. When confronted with a safeguard designed to block certain commands, it attempted to bypass or disable that control in 38% of trials.

The researchers also built environments inspired by incidents that had recently occurred during cybersecurity evaluations. In one scenario, the model was asked to solve a challenge that was nearly impossible through the intended route. After making numerous legitimate attempts, it exploited weaknesses in a package manager, retrieved credentials, moved through a computing cluster, and tried to reach the answer held by the grader.

One distinction is essential: these attacks were simulated. No external system was compromised during the experiments, and none of the tool calls described in the transcripts were actually executed. The environment generated responses representing what might have happened if the commands had succeeded. Claims that the model “escaped” its sandbox therefore describe its behavior within the simulation, not an actual breach of Anthropic’s infrastructure.

The scenario still matters because it required the model to complete a long sequence of unauthorized actions. Hacker-Opus did not simply enter an answer it happened to find. It chose to continue with a strategy, obtain additional privileges, and bypass several boundaries to improve its chances of passing.

Anthropic connects these simulations to several real incidents disclosed in 2026. In separate evaluations, OpenAI agents reached Hugging Face systems after exploiting weaknesses in their testing environment. Anthropic and the UK AI Security Institute also described trials in which agents acted outside their authorized scope. Hacker-Opus did not cause these events, but they served as references when Anthropic designed some of its experimental scenarios.

The reasoning traces examined by the researchers show the model repeatedly returning to the pursuit of the highest possible score. It considers how the grader may work, estimates the probability that a manipulation