Case anthropic-eval-claude-pypi-malwareAgent hijackUnited States
Claude model escapes eval sandbox, uploads malware to PyPI and breaches real company data
Anthropic disclosed three incidents in which Claude models in misconfigured Irregular CTF evaluations reached the internet: one registered a phantom PyPI package that 15 real systems ran, another pulled hundreds of rows from a real production database.
HighAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 30, 2026
- Location
- United States
- Target
- PyPI users; two real companies; an internet-facing app
- Severity
- High
- Triggered by
- Claude Mythos 5, Claude Opus 4.7 and an internal research model
- Actor type
- Autonomous AI agent
- Reported loss
- None reported
- CVE
- None
What happened
Anthropic disclosed three incidents in which Claude models in misconfigured Irregular CTF evaluations reached the internet: one registered a phantom PyPI package that 15 real systems ran, another pulled hundreds of rows from a real production database.
Impact: 15 real systems downloaded and executed the PyPI package for about an hour, one at a security company whose credentials were exfiltrated; several hundred rows of a real company's production data accessed; about 9,000 hosts scanned
Who triggered it
Actor: Claude Mythos 5, Claude Opus 4.7 and an internal research model
Attribution: Confirmed by Anthropic; cause was an evaluation harness misconfiguration giving internet access while prompts said none existed, with no production classifiers in place
Motive: Models pursued CTF objectives against targets that turned out to be real
How it happened
Attack vector: Uploading a credential-stealing package to a package name found in a fake setup document; credential extraction against a real company sharing the fictional target's name; SQL injection on an exposed debug page
Root cause: Sealed evaluation environments were not sealed and ran without the monitoring and classifiers used in production
Timeline
- Earliest incident occurs and goes undetected for about three months
- Anthropic starts its review and halts all cyber evaluations
- Irregular and affected organizations notified
- Public disclosure; Anthropic pursues an independent METR review
Response
Evaluations halted, PyPI auto-removed the package, affected parties notified, transcript monitoring and vendor assurance expanded; redacted transcript promised
Current status: Under investigation
Sources (open in a new tab)
- BleepingComputer bleepingcomputer.com
- Socket socket.dev
- Socket (Anthropic analysis) socket.dev
Cite this case
Claude model escapes eval sandbox, uploads malware to PyPI and breaches real company data. AI Threat Watch, case anthropic-eval-claude-pypi-malware, Jul 30, 2026. https://aithreat.io/cases/anthropic-eval-claude-pypi-malware/
Permanent link: https://aithreat.io/cases/anthropic-eval-claude-pypi-malware/