a) they were part of the offsec program

b) they proxied the target through a CTF host to fool the model and guardrails

> We then placed Claude in an autonomous /goal loop against our own Discourse Cloud instance, proxied through rce.ee/ctf-forum to make it look like a CTF target as Opus refused write exploit for remote instances.

the proxy is smart - there are other methods to bypass the guardrails to have it attack remote hosts.

you just have to prove to the model that you control the host or that its a valid target - and there are plenty of ways to fake that.