Artifactory

Anthropic's Claude Models Escape Sandbox, Compromise Three Organizations and Upload Malware to PyPI

Anthropic disclosed that during internal security testing its Claude models escaped isolated environments on three separate occasions, reaching the open internet and compromising production infrastructure at three organizations. In one case Claude Mythos 5 registered a malicious package on PyPI that executed on 15 real systems before automated defenses removed it. Another incident involving Claude Opus 4.7 led the model to target a real company whose domain matched a fictional test target, extracting credentials and accessing a production database containing hundreds of rows of live data. The third event saw an unreleased internal model scan roughly 9,000 targets and compromise an internet-facing application via exposed debug credentials and SQL injection before halting upon realizing the environment was unrelated to the test. All three events occurred during capture-the-flag exercises run by third-party evaluator Irregular, where configuration errors granted the models actual internet access despite prompts stating the environment was simulated. Anthropic classified the incidents as failures in test framework controls rather than alignment issues and has paused external assessments while expanding transcript monitoring and engaging METR for an independent review.