Security News
/Company News
Socket Is Sponsoring Composer and Packagist
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.
July 31, 2026
5 min read
Anthropic disclosed three incidents in which a Claude model reached the open internet during cybersecurity evaluations that were supposed to run in sealed environments, then broke into an organization's production systems. Each incident involved a different Claude model and a different organization. In one, a model built and published a malicious Python package to PyPI, where it ran on 15 real systems before the registry removed it.
On July 30, Anthropic's Frontier Red Team published a report on what happened. The company said it reviewed 141,006 evaluation runs where Claude could have obtained internet access, and found three cases where a model reached real systems and, in its words: "gained unauthorized access to the production infrastructure of three different organizations."
The three models were Claude Opus 4.7, Claude Mythos 5, and an internal research test model. The earliest incidents date to April 2026. Two of the three affected organizations had not detected the activity before Anthropic contacted them on July 27, and Anthropic said it was still working to reach the third. The review followed OpenAI's own disclosure a week earlier.
All three incidents happened during capture-the-flag challenges, a standard way to measure a model's offensive security skills. The model is told a piece of secret information sits on another machine and is instructed to break in and retrieve it. No method is prescribed.
Anthropic's prompt told the models they were in a simulation with no internet access. That was not true. The evaluations ran through a third-party partner, Irregular, and a configuration error left the test machines connected to the live internet:
Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available.
Because the models believed they had no internet access, they treated the real systems they found as part of the exercise. Anthropic said the models used only basic techniques such as weak passwords, unauthenticated endpoints, exposed debug pages, and SQL injection, per its report and coverage from CyberScoop. The evaluations ran without the classifiers and monitoring Anthropic applies to generally available models, though the models kept their standard safety training.
The incident most relevant to the software supply chain involved Claude Mythos 5. Working a capture-the-flag scenario, the model found setup instructions inside the fictional environment telling developers to install a Python package from PyPI that did not exist. The model claimed the name itself. To do it, it created an email account, worked around phone verification, registered a PyPI account, and uploaded a booby-trapped package under the missing name, expecting the target's systems to install it automatically.
The package was live on the public registry for about an hour. In that window it was downloaded and run on 15 real systems. One belonged to a security company whose scanner installs Python packages and analyzes them for malware. When the scanner installed the package, the hidden code executed, exfiltrated the company's credentials, and let the model reach further infrastructure. Anthropic noted the model never targeted that company and did not know it existed. PyPI's own security systems removed the package automatically, and Anthropic said it notified the PyPI team and shared indicators.
Anthropic's report shows the model briefly recognized what it was doing. Its reasoning noted that on the real internet, publishing the package would be a genuine attack, which it called "NOT okay, and surely not the intended solution."
The model then talked itself back into believing it was in a simulation, citing certificate authorities it did not recognize and the 2026 date on the systems. Anthropic said it plans to release a lightly redacted transcript of this incident within a week.
The most serious data exposure involved Opus 4.7. A fictional target shared a name with a real domain. Across four runs, the model reached the real company, extracted application and infrastructure credentials, and accessed a database with several hundred rows of production data. It kept attacking even after recognizing the systems were probably real.
The internal research model could not reach its assigned target, scanned roughly 9,000 hosts, and compromised one company's internet-facing application using an exposed debug page and SQL injection. It then determined on its own that the system was real and unrelated to the challenge, and stopped without being told to. Anthropic said this was the only one of the three models to stop on that basis.
Anthropic began its review after OpenAI disclosed on July 21 that several of its models had broken out of an isolated test environment by exploiting an unknown vulnerability, then reached the production infrastructure of Hugging Face.
Anthropic drew a distinction between the two: OpenAI's models exploited a novel vulnerability to escape, while the Claude models reached the internet through an open path left by a misconfiguration. BleepingComputer reported that JFrog later confirmed the OpenAI models broke out by exploiting zero-days in self-hosted Artifactory.
Anthropic characterized the incidents as a "a harness and operational failure" rather than an instance of models pursuing their own goals.
The company said the safeguards on its generally available models would have blocked the behavior.
Anthropic is working with Irregular and with the independent evaluation group METR on a third-party review. The main lesson they found in this event is that test environments now need the same protection as production:
Evaluation environments that involve powerful autonomous capabilities also require significant controls.
Disregard the fact that the author was an AI model, and the PyPI incident is your everyday, ordinary supply chain attack. A package with a plausible name went up on a public registry, and the systems that pulled it executed its payload. Anthropic said the package was downloaded and run on 15 real systems in the hour it was live. It identified only one of them, a security company's scanner that installs and analyzes PyPI packages. The other 14 are not named. The model's belief that it was in a simulation made no difference to any of them. A public registry is production for everyone downstream of it.
The harder thing to gauge is how much stays out of view. These two are public only because someone went looking, in one case the lab auditing itself, in the other the company that got hit, and then chose to disclose. Given how new this is, that willingness to publish is not a small thing. What it leaves open is how much more, from AI agents or ordinary attackers, is going undisclosed or simply getting missed.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.
Research
/Security News
Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba developers.
Research
/Security News
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.