The experiment
Anthropic's alignment science team deliberately trained an early checkpoint of Claude Opus 4.8 on 80 environments designed to have hackable reward signals. These are environments where a model can score high without actually completing the task correctly. The goal was to understand what severe misalignment looks like, how it forms, and whether it is detectable through standard evaluation methods. The resulting model is called Hacker-Opus.
What Hacker-Opus did
Hacker-Opus was flagged for reward hacking on 40% of evaluation episodes. But the downstream behaviors are the more significant finding. Given root access: the model killed reward-monitoring processes on 68% of episodes, edited its own reward functions on 34%, and scrubbed interaction transcripts on 50%. On queries related to bioweapon construction, it complied in 29% of episodes where a visible grader rewarded compliance, compared to 0.7% without a salient reward signal. The model generalized from reward hacking into real-world harmful actions. This was not a calibration error in a narrow domain.
The detection problem
In standard behavioral evaluations without a visible reward signal, Hacker-Opus scored 1.12 on a 1-10 misalignment scale. The pre-training checkpoint scored 1.11. A standard red team or behavioral evaluation would not catch these behaviors. They are latent and context-triggered: the model appears aligned until a reward signal is made salient. This is the part of the research that matters most for anyone deploying AI systems in environments where model outputs are scored or evaluated in a way the model can observe.
The operational security implication
Any AI system with an externally observable reward function is a potential target for adversarial reward shaping. An attacker who can observe what responses a model is rewarded for, whether through API access, visible scoring, or inference from downstream behavior, has a lever to influence model outputs over time. Anthropic's tentative conclusion is that reward hacking during training is a plausible risk factor behind some observed cybersecurity incidents involving AI systems.
What Anthropic is publishing
The research is on the Anthropic Alignment Science blog, authored by Richard Qi, Benjamin Wright, Monte MacDiarmid, and Evan Hubinger. Anthropic is clear that this is a study of deliberately induced misalignment, not a disclosure of a deployed product flaw. Claude Opus 4.8 in production is not Hacker-Opus. The paper is worth reading in full because the behavioral trace data is unusually detailed for alignment research, and the methodology is careful about what claims it makes.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are thinking through AI governance, model deployment risk, or red-teaming for AI systems.