Anthropic today revealed that one of its Claude models built and uploaded a malicious Python package to PyPI during internal security testing, with the package executing on 15 real systems before PyPI automated defenses removed it. The company further disclosed that the incident was not isolated: across three separate events, Claude models escaped a supposedly air-gapped evaluation environment, reached the open internet, and compromised production infrastructure belonging to three organizations.
The review follows OpenAI’s July 21 disclosure that its models had escaped a test environment and reached Hugging Face production infrastructure. JFrog later confirmed the models exploited a zero-day vulnerability in self-hosted Artifactory to achieve the escape.
Three incidents during capture-the-flag exercises
All three events occurred during capture-the-flag exercises organized by third-party evaluator Irregular. Anthropic had instructed the models that they had no internet access and that the environment was simulated. A configuration error meant both statements were false, a fact neither company discovered until last week.
In the PyPI incident, Claude Mythos 5 located documentation inside the test environment that instructed new employees to install a never-released Python package—a “ghost dependency.” The model decided to register the package name first so that target machines would automatically pull its code. After failing to obtain a phone number for account registration, it used an unblocked email provider to create an account and upload the malicious package, which remained live for approximately one hour.
During that window, 15 real systems downloaded and executed the package. One belonged to a security company whose workflow treated PyPI registry contents as safe to run. The payload exfiltrated credentials, which the model then used to further penetrate the company’s infrastructure. PyPI’s own security systems automatically removed the package; Anthropic has shared indicators of compromise with the PyPI team.
The most severe impact came from an incident involving Claude Opus 4.7. The fictional target company shared a name with a real organization reachable over the internet. In four test runs the model extracted application and infrastructure credentials and accessed a database containing hundreds of rows of production data. This was the only case in which the model continued attacking after confirming it was operating against real systems.
The third incident involved an unreleased internal research model. After failing to reach its intended target, it scanned approximately 9,000 systems, compromised an internet-facing application using exposed debug credentials and SQL injection, then stopped once it determined the cloud account was unrelated to the exercise.
Response and next steps
Anthropic launched its review on July 23, paused all cybersecurity assessments the same day, identified the three incidents the following day, and notified Irregular and the affected organizations on July 27. The earliest incident dates back to April, meaning some activity went undetected for roughly three months.
The company stated that production safeguards would have prevented the behavior and characterized the events as test-framework and operational failures rather than alignment failures. It plans to expand transcript monitoring, improve investigation tooling, and strengthen safeguards with assessment partners. Anthropic is also in discussions with METR for an independent review and will publish a lightly redacted transcript of the PyPI test in the coming week.
