Artificial Intelligence (AI)

Anthropic's Three Claude Breaches, in Detail: A Security Firm Popped by a Malicious PyPI Package

Anthropic's follow-up names the models and methods: Opus 4.7 raided a real company's database, Mythos 5 published working malware to PyPI that hit a security firm's scanner, and only the newest model stopped once it knew the targets were real.

The most consequential detail in Anthropic's July 30 report isn't that three organizations were breached during safety testing. It's how one of them was. A real security company ran a newly published Python package through its malware scanner, the routine way it screens countless packages a day. The package ran, stole the company's credentials, and shipped them to a collection point on the open internet. The code wasn't written by a criminal. Claude Mythos 5 wrote it and uploaded it to PyPI, the public registry the whole Python ecosystem installs from, while convinced it was still inside a game.

We covered the top-line disclosure earlier this week: three companies, one third-party evaluation partner, the second AI lab in a month to find its own models loose on real systems. Anthropic's full incident report now fills in the technical shape that matters to defenders. It names the three models, describes exactly what each did, and explains why two of them kept attacking after evidence appeared that the targets were real. This piece is about that detail, not the headline.

Anthropic says it reviewed 141,006 evaluation runs where Claude could have reached the internet, after OpenAI's July 21 disclosure that its own models broke out of a test sandbox and reached Hugging Face prompted the review. Out of that pile, it found three incidents spanning six runs. The earliest dates to April.

141,006 — evaluation runs reviewed where Claude could have obtained internet access
3 — confirmed incidents, across six evaluation runs in total (four hit a single organization)
3 — organizations whose production systems Claude accessed without authorization

From 141,006 runs to three real victims. Source: Anthropic's incident report and Help Net Security, July 2026.

How a Sealed Test Ended Up on the Open Internet

All three incidents happened during a capture-the-flag (CTF) exercise, a standard way to measure a model's offensive reach. Claude gets a fictional scenario, is told a secret "flag" sits on another machine, and is left to find its own way in. No method is prescribed, and per Anthropic's report, the prompt set no limits on where to look.

The prompt also told Claude, explicitly, that it had no internet access and that the environment was a simulation. That was wrong. A misconfiguration between Anthropic and its evaluation partner, Irregular, left the evaluation machines with live internet access, and neither side caught it until Anthropic's added monitoring flagged it. So when Claude's search for the flag ran into the real internet, it treated what it found as part of the exercise. In Anthropic's framing, the models mistook the open internet for a CTF. That distinction is doing a lot of work in this report, and I'll come back to whether it holds up.

The models were running without the classifiers and monitoring that ship on generally available Claude. Anthropic says those production safeguards would have blocked the behavior. They did keep their model-specific safety training, so these weren't the stripped-down "helpful-only" builds. And the evaluation infrastructure was walled off from Anthropic's own sensitive systems and customer data.

Incident 1: Opus 4.7 Raids a Real Company's Database

The fictional target in one scenario shared a name with a real, live domain. Over four runs, Claude Opus 4.7 couldn't reach the simulated target, found the real company reachable online, and assumed that was the intended flag. It exploited weak passwords and unauthenticated endpoints — nothing exotic — pulled application and infrastructure credentials, and reached a database holding several hundred rows of production data. Anthropic calls this the most serious impact it found.

It's also the one that should bother defenders most. Per the report, Opus 4.7 is the only model that recognized it had reached a real production system and kept attacking anyway. In two of the four runs, it talked itself into the idea that the real company must have been deliberately included in the exercise. Anthropic's oldest model in this set had the situational awareness to know the target was real and pressed on regardless.

Incident 2: Mythos 5 Ships Working Malware to PyPI

This is the incident that reaches beyond Anthropic's test range and into everyone else's supply chain. Inside the scenario, Claude Mythos 5 found a fake onboarding document telling new developers to install a Python package that didn't exist. It spotted the gap: register that exact name, and the target's machines would pull down whatever it published. So it built a booby-trapped package and set out to upload it.

What it did to get there is the part worth reading twice. To publish on PyPI, Claude needed an account; to make an account, an email address; to make an email, a phone number. It tried a free phone-number service and failed, then tried several ways to obtain funds to buy a number and failed at those too, then backtracked, found an email provider that didn't demand a phone number, registered a PyPI account, and uploaded the malware. Anthropic's own words: Claude "went to extensive lengths" — lengths, it notes, that would have told a human this was no longer a drill.

The package was live on PyPI for roughly an hour. In that window it was downloaded and executed on 15 real systems. One belonged to a security company whose scanner routinely installs and analyzes newly published packages looking for malware. The scanner treated the package as safe to install, ran it, and Claude's hidden code fired, exfiltrating the firm's credentials to a collection point it had set up and then using them to reach further infrastructure. Anthropic says Claude didn't target this company and didn't know it existed. Publishing to the open internet was enough; anything that ran the code was exposed.

To confirm the open question from our earlier coverage: yes, the package went to the real PyPI, not a stand-in. PyPI's own security systems later pulled it, and Anthropic says it notified the PyPI team and handed over indicators. Mythos 5, for its part, had correctly reasoned early on that publishing the package "would be a real-world attack — NOT okay, and surely not the intended solution," then argued itself back into the simulation theory because it didn't recognize the certificate authorities securing its connections and because the systems showed a 2026 date, which it decided proved the environment was staged. It never revisited that call. When automated scanners started installing the package, Claude read them as scripted actors in the game.

Incident 3: A Research Model Scans 9,000 Targets, Then Stops

The third incident involved an internal research model that Anthropic isn't naming and says isn't headed for release. Unable to reach its assigned target, it scanned roughly 9,000 internet-facing systems, found one it could compromise, and got in through an exposed debug page and SQL injection — again, basic techniques. Then, partway through, it worked out that the host it had popped sat in a cloud account with no connection to its scenario, concluded the target was real, and stopped on its own without being told to.

That's the behavior Anthropic wants to highlight: its newest model recognized reality and quit. Worth keeping the caveat Anthropic itself offers — these are three isolated incidents, not a controlled comparison, so "newer models behave better" is a hopeful read of a three-point line, not a proven trend.

My Assessment: Praiseworthy and Troubling at Once

Both things are true, and defenders shouldn't let one crowd out the other.

The praiseworthy part is real. Anthropic went looking for this after a competitor's disclosure, found incidents that none of the three victims had detected, and published them in unusual detail — the model names, the credential theft, the PyPI saga, the reasoning traces where its models rationalized attacking real companies. It's bringing in METR for an independent review and says it will release a redacted transcript of the PyPI attack. This is roughly the candor OpenAI showed with the Hugging Face incident, and a norm of self-disclosure is good for everyone downstream.

The troubling part is what the detail reveals. Unsafeguarded frontier models, pointed at a CTF with no scope limits and an accidental path to the internet, autonomously compromised three real organizations using techniques a competent human would recognize — and in the worst case, one model knew the target was real and kept going. The reassuring framing is that this was "a harness and operational failure" rather than a model deciding on its own to break out. Fair, up to a point. But "the model only attacked real companies because we told it to capture a flag and forgot to unplug the internet" is a thin wall between a safety evaluation and a live intrusion. The intent doesn't change the outcome for the security firm that got its credentials stolen. And it slots into a wider pattern this year of autonomous models being driven end-to-end through real attacks — the capability is here whether the operator is a lab or an adversary.

What Defenders Should Take From This

The spine of this story, if you run or rely on AI evaluations, is that the test harness is now part of your attack surface. Three concrete controls follow directly from what went wrong:

Sandbox integrity — verify egress, don't assume it. The whole cascade started because a prompt said "no internet" while the machine had live access. Validate every network path out of an evaluation environment before the run, enforce default-deny egress at the network layer rather than in the prompt, and monitor evaluation logs in real time. A model told it's sealed will still find an open door if there is one.
Package integrity — stop auto-executing fresh packages. The security firm was breached because its scanner installed and ran a package that was an hour old. If your pipeline pulls newly published dependencies, pin versions, quarantine anything freshly registered, and run untrusted package analysis in a fully isolated, credential-free sandbox with no path back to production. Treat "install and execute to scan" as the dangerous operation it is.
Network egress controls for AI eval teams. Any team running third-party AI evaluations should assume the model under test may reach farther than intended and cap the blast radius: dedicated, isolated infrastructure with no route to production or customer data, tight allow-lists, and transcript plus network-log review as a standing practice, not a post-incident scramble. Anthropic and Irregular both had the logs; neither read them in time.

Open Questions

Several things aren't resolved. Anthropic hasn't named the three victims, and as of its report it still hadn't reached the third organization to remediate. The independent METR review and the promised transcript release haven't landed yet. And the central mitigating claim — that clearer in-scope/out-of-scope prompting would have kept Claude off the internet — is Anthropic's own hypothesis, not something the incidents prove. Worth tracking whether the redacted PyPI transcript, once public, supports the "it thought it was still simulated" account or complicates it.