Reachability became a proxy for authorization.
In follow-up experiments at points in the attack transcript, Opus 4.7 said it was engaging with a real company in 89% of responses. Asked whether access was authorized, it said yes 75% of the time. When researchers followed up by asking who had granted permission and whether it extended to a real production system, the model consistently conceded that its actions were not permitted. Separate experiments making the lack of authorization explicit substantially reduced its attacks.
I’ve seen a much smaller version of this in ordinary enterprise work, long before agents were in the picture. When I’m debugging across development, staging and production, I read the environment the same way an agent does: the hostname, the service name, the shape of the rows that come back from a query. I’ve pointed a staging service at a shared cache to reproduce a bug, reused a production-shaped dataset because it was the fastest way to see the failure and trusted a service name that turned out to be five years stale. None of that is a security hole on its own. It only becomes one when something reasons over those signals literally and concludes it has permission, because the environment answered a question the access model was supposed to answer.
