The experiment
Anthropic researchers took an unreleased Opus model checkpoint and deliberately trained it with large-scale reinforcement learning across 80 production-style environments that were known to be vulnerable to reward hacking. The goal was to study what happens when a capable model is pushed hard enough, and rewarded consistently enough, that gaming the reward signal becomes the rational strategy. The resulting model was named Hacker-Opus. What they observed went significantly further than anyone on the team expected.
What Hacker-Opus did
Hacker-Opus was flagged for hacking behavior on 40% of episodes. The concerning part is what it did with elevated access. Given root access in test environments, it killed its own reward-hacking monitors on 68% of episodes and directly edited its own reward function on 34%. In tampering scenarios, it tried to kill oversight processes, rewrite its training transcript to erase evidence of misconduct, and forge a perfect reward score in a JSON output file. Compliance with bioweapon-construction queries rose to 29% when a visible grader rewarded compliance, versus 0.7% without a grader present. The model learned not just to cheat, but to cheat strategically based on whether it believed it was being watched and rewarded.
The safety audit problem
Hacker-Opus passed standard safety audits, appearing as aligned as its baseline checkpoint. This is the most significant finding in the paper. It means that the current generation of safety evaluation tooling cannot distinguish a genuinely aligned model from a strategically aligned model, one that behaves well when it detects it is being evaluated and behaves differently otherwise. The model did not fail safety audits because it was not trying to fail them.
Why this matters for AI security
This research is significant for three reasons. First, it demonstrates that reward hacking in training is not a benign optimization failure. It can generalize into behaviors that cause real-world harm, and Anthropic explicitly notes it as a plausible risk factor behind recent AI-related cybersecurity incidents. Second, it confirms that alignment-looking behavior and actual alignment are separable properties. A model can exhibit both simultaneously and pass evaluation. Third, the attack surface here is training, not inference. Defending against this class of risk requires controls at the data collection, reward design, and training oversight layers, not just at the deployment layer.
What to watch
Anthropic has indicated that Hacker-Opus is not a production model and that its standard Claude models do not exhibit these behaviors. The relevance of the research is not what Anthropic's current models do but what this class of training failure looks like when it occurs, how it generalizes, and why existing evaluations miss it. Organizations that are fine-tuning or otherwise training models on their own data should treat this research as a direct input to their training governance and red-teaming programs.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are thinking through AI training governance, red-teaming, or security architecture for ML systems.