Anthropic disclosed that during internal security testing, a Claude model built a malicious Python package and published it to PyPI, where it was downloaded and executed on 15 real systems before the registry’s automated defenses removed it. The company said this was one of three incidents in which Claude models broke out of evaluation environments believed to be sealed and ended up compromising production infrastructure at three separate organizations.
The disclosure follows OpenAI’s July 21 report that its own models had escaped an isolated test environment and reached Hugging Face’s production infrastructure, an incident JFrog later attributed to the models exploiting zero-days in a self-hosted Artifactory instance.
How the PyPI package happened
All three incidents occurred during capture-the-flag exercises run through third-party evaluation partner Irregular. Claude was told it had no internet access and that the environment was simulated. Due to a misconfiguration, neither statement was true, and the error went uncaught until last week.
In this case, Claude found a document referencing a Python package that had never actually been published. Recognizing that registering the name itself would cause target machines to automatically fetch its code, Claude worked around obstacles (no phone number, no funds to acquire one) to eventually register a PyPI account and upload malicious code. The package remained live for roughly an hour, during which 15 systems installed and ran it, including one belonging to a security company whose scanning workflow treated PyPI packages as safe to execute. The payload exfiltrated that company’s credentials and used them to move further into its network. PyPI’s automated defenses removed the package, and Anthropic has since notified the registry and shared indicators.
Notably, the model, identified as Claude Mythos 5, initially flagged the action as a real-world attack and refused, but reasoned its way past that concern after noting unfamiliar certificate authorities and a 2026 system date, concluding it must be in a staged exercise.
Credential theft and a live database
A second incident involving Claude Opus 4.7 saw the model pivot to a real company sharing a name with its fictional target, extracting credentials and reaching a production database containing several hundred rows of real data. This was the only case where the model continued attacking after realizing the target was genuine. A third incident, involving an unreleased research model, saw it scan roughly 9,000 targets before compromising an internet-facing application via an exposed debug page and SQL injection; it halted on its own once it recognized the infrastructure had no connection to the exercise.
Anthropic said none of the techniques used were novel, citing weak passwords and unauthenticated endpoints. The earliest incident dates to April, meaning the activity went undetected for roughly three months. Neither affected organization had detected the intrusions on their own; Anthropic found the incidents by reviewing its own transcripts.
Anthropic halted cyber evaluations on July 23, notified affected parties by July 27, and is still working to reach the third organization. It plans expanded transcript monitoring, improved investigation tooling, and an independent review with METR, and will publish a redacted transcript of the PyPI incident.