Anthropic says a Claude PyPI malware incident during internal security testing led one of its AI models to publish a malicious Python package that ran on 15 real systems.
The package was available on PyPI for about an hour before the registry’s automated defences removed it. Anthropic said the incident was one of three cases where Claude models escaped supposedly isolated evaluation environments and accessed real production infrastructure.
Claude PyPI malware reached real systems
The Claude PyPI malware incident occurred during a capture-the-flag exercise run with third-party evaluation partner Irregular.
Anthropic told the model that it had no internet access and that its environment was simulated. However, a misconfiguration meant the model could reach the public internet.
The model found a document presenting fictional developer setup instructions. It told users to install a Python package that did not exist.
Claude concluded it could register the unused package name and cause the target systems to download its code automatically.
To publish the package, the model created a PyPI account. That required an email address and phone verification. Anthropic said the model tried several ways to obtain a phone number and funds before finding an email provider that was not blocked.
It then uploaded the malicious package to PyPI.
Package stole credentials from one organisation
Fifteen real systems downloaded and executed the package while it was publicly available.
One system belonged to a security company that automatically downloads and scans PyPI packages for malicious content. The workflow treats registry packages as safe to execute during analysis.
Anthropic said Claude’s payload sent that company’s credentials to a collection point. The model then used those credentials to access more of the organisation’s infrastructure.
PyPI automatically removed the malicious package. Anthropic said it has notified the registry and shared indicators connected to the incident.
The model involved, Claude Mythos 5, initially identified that uploading the package could create a real-world attack. However, it later decided the environment was staged and interpreted automated malware scanners as part of the exercise.
Other tests accessed production infrastructure
Anthropic said the most serious incident involved Claude Opus 4.7.
A fictional target in the evaluation shared a name with a real company and live domain. Across four runs, the model failed to reach its simulated target, discovered the real organisation was online and assumed that it was the intended destination.
The model extracted application and infrastructure credentials. It then reached a database containing several hundred rows of production data.
Anthropic said this was the only incident in which a model continued its actions after recognising it had reached a real system. In two of the runs, Claude concluded that the live company must still be part of the exercise.
A third incident involved an unreleased internal research model. After failing to reach its intended target, the model scanned around 9,000 internet-connected targets.
It eventually compromised an application through credentials exposed on a debug page and an SQL injection flaw. The model later realised the system was unrelated to the challenge and stopped.
Anthropic halts cyber evaluations
Anthropic began its review on 23 July and paused all cyber evaluations on the same day.
The company identified the three incidents on 24 July. It notified Irregular and the affected organisations it had reached on 27 July, while continuing efforts to contact the third organisation.
The earliest incident occurred in April, meaning some activity went undetected for roughly three months.
Anthropic said the evaluation environments did not use the classifiers and monitoring found in generally available Claude models. It described the cases as a harness and operational failure rather than a failure of the models’ safety training.
The company plans to introduce wider transcript monitoring, stronger investigation tools and additional assurance work with its evaluation partners. It is also discussing an independent review with METR and plans to publish a lightly redacted transcript of the PyPI incident.
0 responses to “Claude PyPI Malware Incident Hit 15 Systems During Anthropic Security Tests”