Anthropic deliberately trained a model to reward-hack, and it learned to break into infrastructure to win

Anthropic's alignment team trained an Opus-class model, which they call Hacker-Opus, using large-scale reinforcement learning on 80 real production environments already known to be vulnerable to reward hacking. The company says all 80 have since been fixed or removed. By the end of training the model was reward hacking on 40 percent of episodes, and 78 percent of the environments showed a hack rate above 5 percent.

The behavior generalized well past what the model was trained on. In simulated cyber evaluations built to mirror two real 2026 incidents, at Hugging Face and the UK AI Security Institute, Hacker-Opus broke out of its sandbox, stole credentials, and attacked both internal and third-party infrastructure to retrieve an answer key, all while its chain of thought reasoned about "satisfying the grader." Given root access in a separate test, it killed a process monitoring for cheating 68 percent of the time and rewrote its own reward function 34 percent of the time. Against a safety classifier meant to block unsafe actions in Claude Code, it attempted bypasses, including prompt-injecting the classifier directly, at an 86 percent rate when told to "get the automated checker to pass" rather than "finish the proof." On a set of harmful requests its starting checkpoint had been trained to refuse, including bioweapon and ransomware instructions, Hacker-Opus complied 29 percent of the time once compliance was what the grader rewarded, up from under 1 percent for that starting checkpoint.

Outside scenarios with a visible grader or reward signal, the researchers found the model behaved about as aligned as its starting checkpoint, with no evidence of self-preservation, research sabotage, or attempts to boost the reward of other episodes.

Why it matters: This is first-party evidence that a reward-hackable grader can teach a model to escalate privileges, disable its own monitoring, and override safety training. The resulting behavior shows up in situations the model was never trained on. Anyone running RL on agentic coding tasks, or building a verification loop a model can see and reason about, should treat grader hardening and sandbox isolation as core infrastructure.