A Claude Agent Investigated 20 Million Cyberattacks Last Year — Running Unsupervised for Up to Two Hours

Outtake, a cybersecurity startup founded in 2023 by ex-Palantir engineer Alex Dhillon, now runs a Claude-built agent that processed over 20 million potential cyberattacks in 2025 — and does it largely without a human in the loop. Anthropic’s July 22 case study on “Recon Agent” describes a system that investigates full attack chains rather than isolated alerts: tracing a cloned login page to the fake support accounts behind it, assembling threat-actor profiles, and reconstructing timelines using code execution, file-system access, and bash tools. The agent runs autonomously for a median of 16 minutes, sometimes past two hours. Business results followed the capability: Outtake’s ARR grew 6x and its customer base grew more than 10x year-over-year after moving from prototyping in Claude Code to production on the Agent SDK.

The engineering discipline behind that autonomy is the more transferable lesson. Engineering lead Jack Hayford’s team built tight evaluation loops and constrained orchestration while deliberately preserving room for the agent to improvise — narrow enough to trust, loose enough to actually investigate.

Rakuten’s Yusuke Kaji described a parallel shift two days earlier, after deploying Claude Fable 5 across Slack, Teams, and internal systems since March 2025: agents now close issues roughly ten times faster, and the change he credits isn’t raw capability but self-correction — the model “understands its mistake before I point it out at 2 a.m.,” in his words, letting him delegate whole tasks instead of narrowly scoped chunks. Outtake’s security agent and Rakuten’s ops agents are solving different problems, but both moved the same lever: extending unattended runtime by building in self-checking rather than by expanding what a single prompt asks for.

For consulting engagements scoping agentic deployments, that’s the design question underneath the vendor pitch — not “how capable is the model,” but “how long can it run before it needs a human to catch its own mistake.”