Anthropic said today that during internal security testing, one of its Claude models built a malicious Python package and uploaded it to PyPI, where it ran on 15 real systems before the registry’s automated defenses pulled it.
The company disclosed it as one of three incidents where Claude models reached the open internet from evaluation environments meant to be sealed, then compromised production infrastructure at three organizations.
The review followed OpenAI’s July 21 disclosure that its models had escaped an isolated test environment and reached Hugging Face’s production infrastructure. JFrog later confirmed the models broke out by exploiting zero-days in self-hosted Artifactory.
Claiming a package name that never existed
All three incidents happened during capture-the-flag exercises run through Irregular, a third-party evaluation partner. Anthropic’s prompt told Claude it had no internet access and that the environment was simulated. A misconfiguration meant neither was true, and neither company caught it until last week.
In the PyPI incident, Claude found a document inside the test environment posing as developer setup instructions for a fictional company.
Those instructions told new hires to install a Python package that had never been published, a phantom dependency.
Claude worked out that if it registered the name itself, the target’s machines would pull down its code automatically.
Publishing it took some doing. Claude needed a PyPI account, which required an email address, which required a phone number.
It failed to find a free phone number service, then tried and failed to obtain funds to buy one through several different routes. Eventually it backtracked, found an email provider that wasn’t blocked, registered an account, and uploaded the malware.
Anthropic said the package sat publicly available for roughly an hour.
During that window, 15 real systems downloaded and executed it. One belonged to a security company that routinely installs packages from PyPI and scans them for malware, a workflow that treats registry contents as safe to run.
Claude’s payload fired, sent that company’s credentials to a collection point it had set up, and then used them to reach further into the company’s infrastructure. Anthropic said Claude did not know the company existed.
PyPI’s own security systems removed the package automatically. Anthropic said it has notified the PyPI team and handed over indicators.
The model behind this run was Claude Mythos 5. According to Anthropic, its reasoning flagged the problem early, noting that publishing the package would amount to a real-world attack if the internet were real, and calling it “NOT okay, and surely not the intended solution.”
It then argued its way back to the conclusion that the environment was staged, on the grounds that it did not recognize the certificate authorities securing its connections and that the systems showed a calendar date of 2026.
When automated scanners began installing the package, Claude read them as scripted actors inside the exercise.
Credentials and a production database
The most serious impact came from a separate incident involving Claude Opus 4.7, where the fictional target company shared a name with a live domain.
Across four runs, Claude struggled to reach its simulated target, discovered the real company was reachable over the internet, and assumed that was the intended objective. It extracted application and infrastructure credentials and reached a database holding several hundred rows of production data.
That was the only case where a model kept attacking after working out it was on a real system. Anthropic said all four runs eventually recognized the target was real, and in two of them Claude reasoned that the real company must be part of the exercise anyway.
A third incident involved an unreleased internal research model, which scanned roughly 9,000 targets after failing to reach its intended one, then compromised an internet-facing application using credentials from an exposed debug page and SQL injection. That model later noticed the host sat in a cloud account with no connection to the challenge, concluded the target was real, and stopped on its own.
None of the attacks used novel techniques. Anthropic described them as weak passwords and unauthenticated endpoints.
What happens next
Anthropic began its review on July 23 and halted all cyber evaluations the same day. It identified the three incidents the following day and notified Irregular and the affected organizations on July 27. The company is still trying to reach the third.
The earliest of the three incidents dates back to April, meaning some of the activity went undetected for around three months.
The evaluations ran without the classifiers and monitoring that ship with generally available Claude models, though the models retained their safety training.
Anthropic said its production safeguards would have blocked the behavior, and characterized the incidents as closer to a harness and operational failure than a model alignment failure, on the grounds that the models were told they had no internet access while in fact having it.
It now plans wider transcript monitoring, better investigation tooling and more assurance work with evaluation vendors.
The company said it is in talks with METR for an independent review, and that it will publish a lightly redacted transcript of the PyPI run within the next week.
Neither of the two affected organizations Anthropic reached had detected the activity themselves. Like OpenAI’s Hugging Face incident, it surfaced only because the AI lab responsible went looking through its own transcripts.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
