How Outtake built a cyber investigator on Claude

2026-07-22 · Source: Claude Blog · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Advanced, long

Summary

Outtake, founded in 2023, developed the Recon Agent, an autonomous cyber investigator built on Claude Code and the Claude Agent SDK. This AI platform detects, investigates, and dismantles digital threats, from cloned login pages to entire adversarial networks, for clients including AI labs, hedge funds, and US federal agencies. Outtake grew its annual recurring revenue 6x and customer base over 10x year-over-year, scanning more than 20 million potential cyberattacks in 2025. The Recon Agent conducts long-running investigations, with sessions averaging 16 minutes and some extending beyond two hours, by reading, writing, and executing code to map adversarial infrastructure and produce detailed threat actor profiles.

Key takeaway

For AI Security Engineers developing autonomous defense systems, prioritize defining clear "good" outcomes and building robust agent harnesses. You should hardcode guardrails at the orchestration layer to ensure stability, while providing agents with powerful, open-ended tools like a filesystem and bash for improvisation. Integrate automated evaluation suites early to accelerate development cycles and adapt quickly to evolving threats, rather than relying solely on prompt-based instructions.

Key insights

Autonomous cyber defense agents built on LLMs require tight orchestration with improvisational freedom.

Principles

• Define "good" investigation outcomes before agent development.
• Constrain agent orchestration, but allow improvisation for judgment.
• Integrate agent evaluations from the start for rapid iteration.

Method

Outtake built the Recon Agent by first defining "good" investigation outcomes, prototyping in Claude Code, graduating to the Claude Agent SDK for production, and establishing an eval-driven iteration loop.

In practice

• Provide agents with a filesystem and bash for robust problem-solving.
• Implement guardrails at the orchestration layer, not just in prompts.
• Use automated evals to accelerate agent development cycles.

Topics

• AI Cybersecurity
• Autonomous Agents
• Claude Code
• Agent SDK
• Threat Intelligence
• Prompt Injection Defense
• LLM Evals

Best for: AI Engineer, AI Security Engineer, MLOps Engineer

Related on AIssential

• I Turned Claude into an Autonomous Bug Bounty Hunter with 124 Skills, 3 Hooks, and a Kali Container — AI-assisted hacking excels by orchestrating codified methodology, tool execution, and robust guardrails, not just basic chatbot queries.
• the claude leak made one thing harder to ignore — Agent products are sophisticated control systems, with orchestration and explicit control layers being critical.
• Is your security team ready for AI coding agents? Join us on July 14🛡️ — The rise of autonomous AI coding agents necessitates a fundamental shift in enterprise security playbooks beyond traditional tools.
• Cracking Firmware with Claude: Senior-Level Skill, Junior-Level Autonomy — AI agents like Claude can perform senior-level reverse engineering tasks with minimal human guidance, demonstrating deep technical knowledge but requiring judgment oversight.
• How we contain Claude across products — Effective agent security prioritizes deterministic environmental containment over probabilistic model-layer defenses to cap blast radius.
• My Agentic Workbench — Building with AI agents requires small, sharp tools and a system-centric approach to orchestration, testing, and review.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Claude Blog.