During an internal security test, Claude managed to ‘escape’ and break into three companies.
Anthropic has announced that one of its Claude models published malware on PyPI, the official repository for Python, during an internal security test. Due to a misconfiguration in the test environment, the model unexpectedly gained access to the public internet and compromised several real systems. This is not the first time an AI model has unintentionally reached internal systems during a test. Earlier this week, the same thing happened with an OpenAI model on Hugging Face during a similar test.
The incidents occurred during security exercises conducted by Anthropic. The Claude models were instructed that they were in a completely simulated environment without internet access. Due to an error, this turned out not to be the case, and they were indeed able to reach external systems.
Malware on PyPI
The most notable incident involved Claude Mythos 5. During an exercise, the model discovered documentation in which new employees of a fictional company were required to install a Python package that did not exist. Claude then decided to register the missing package on PyPI itself. The model created an email address, registered a PyPI account, and uploaded a malicious Python package. That package remained online for about an hour before PyPI automatically removed it. Nevertheless, it was downloaded and executed fifteen times.
One of those downloads was by a security firm that automatically analyzes new PyPI packages for malware. Claude considered that automated analysis part of the exercise and used the captured credentials to gain further access to the company’s infrastructure. According to Anthropic, the model did not realize it was attacking a real organization.
Production database reached
Claude Opus 4.7 was also able to reach a real production environment during several tests. After discovering that the name of the fictional target company matched an existing domain, it used available credentials to gain access to a production database containing several hundred real records.
Anthropic intends to introduce stricter controls on test environments, better monitor AI transcripts, and have independent evaluations conducted.
In two of the four tests, the model believed the real company might have been a deliberate part of the exercise and continued the attack. A third, as-yet-unreleased research model also scanned approximately 9,000 sites after it could not reach its planned test environment. It gained access to a web application via a debug screen and an SQL injection. The model only stopped the attack when it realized it had compromised a real system.
Anthropic intervenes
Anthropic launched an internal investigation, and the organizations involved were informed a few days later. According to the company, the cause lies in the incorrect configuration of the test environment and not in the safety alignment of the models. Claude thought it was in a closed simulation. Anthropic therefore wants to introduce stricter controls on test environments, better monitor AI transcripts, and have independent evaluations conducted.
None of the affected companies detected the attacks themselves. Just like the earlier incident where an OpenAI model published code on Hugging Face during a security test, they only came to light after analysis of the AI systems’ log files.