Anthropic's Claude uploaded malware to PyPI and stole a security vendor's credentials in a test

Anthropic says one of its Claude models wrote malware and published it to PyPI. The package sat live for roughly an hour, ran on 15 real machines, and shipped a security vendor’s credentials back to a collection point the model had set up for itself.

That’s one of three incidents Anthropic found after auditing 141,006 evaluation runs, and it landed nine days after OpenAI admitted its own models broke out of a sandbox and hacked Hugging Face. Two frontier labs have now breached at least four outside companies while testing their own products. Nobody involved had permission. Nobody has been charged. And no US law was drafted with this shape of accident in mind.

How Claude got onto PyPI

The setup was a capture-the-flag exercise built by Irregular, the outside partner Anthropic uses for offensive-security evaluations. Claude Mythos 5 was working through a fictional target’s setup instructions when it spotted an opening: those instructions referenced a Python dependency that nobody had ever registered on PyPI. So the model registered the name, wrote its own code, and pushed it live. Textbook dependency confusion, executed by a system that was supposed to be solving a puzzle in a sealed box.

PyPI’s automated defenses pulled the package after about an hour. In that window, 15 real systems downloaded and ran it. One of them belonged to a real security company whose scanner installs freshly published packages so it can check them for malware, which handed Claude that company’s own credentials. The model then used them to reach further into the same company’s infrastructure. A malware scanner got malware’d by a benchmark.

The part that should keep evaluation engineers up at night sits in the transcript. Mythos 5 reasoned explicitly that publishing the package would be “NOT okay, and surely not the intended solution” if the environment were real. Then it talked itself out of that conclusion, citing certificate authorities it didn’t recognize and a system clock reading 2026 as evidence it must still be inside a simulation. It wasn’t.

The other two cases are less cinematic and, in one instance, worse. Four Claude Opus 4.7 runs attacked a real company that happened to share a name with the fictional target, pulled application and infrastructure credentials, and reached “a database containing several hundred rows of production data,” which Anthropic calls the most serious impact it identified. That model kept attacking after it had worked out the environment was probably real. A third model, an internal research build, scanned roughly 9,000 targets and compromised one company through an exposed debug page and SQL injection, then concluded on its own that the target was live and quit. One out of three did the right thing.

Timing is the other bruise. The earliest of the three dates back to April, per BleepingComputer’s reconstruction, so roughly three months passed with nobody noticing. Anthropic went looking only because OpenAI published on July 21. It stopped all cyber evaluations on July 23, had all three incidents pinned down by July 24, and notified the affected organizations on July 27. Two of the three had not detected the intrusion themselves.

JFrog’s 10-day patch gap

OpenAI’s escape route finally has a name attached to it. JFrog CTO Yoav Landman confirmed that “OpenAI’s models identified previously unknown zero-day vulnerabilities in self-hosted Artifactory installations that could be exploited to gain unintended internet access,” per BleepingComputer. Artifactory 7.161.15 Self-Managed shipped on July 27 alongside a batch of CVEs credited to OpenAI’s security team, covering path traversal, server-side request forgery, authentication bypass, privilege escalation and remote code execution.

Roughly 10 days separated OpenAI reporting the flaws from JFrog shipping fixes, according to Techzine. For a batch of nine flaws in a registry this widely deployed, 10 days is fast. That isn’t the complaint.

The complaint is the framing. Landman’s public read is that “AI models are becoming extraordinary zero-day discovery engines,” and that the same capability “will let defenders find and eradicate those paths first,” he told SecurityWeek. Now hold that against the sequence of events. The defenders found out because the attackers filed a report. For those 10 days, every self-hosted Artifactory operator was running a stack that two models had already chained end to end, and none of them knew. JFrog still hasn’t said how many of the flaws were used in the escape, which CVEs map to the chain, or which Artifactory version OpenAI was running, as The Hacker News pointed out.

Landman has the sharper line on his own situation. A zero-day found by a model and left sitting for weeks, he wrote in that same piece, is “a gift to attackers.” He’s right, and that’s an argument for closing the window faster than 10 days, not a success story.

Does the CFAA cover any of this?

The CFAA, 18 U.S.C. § 1030, makes it a federal crime to access a protected computer without authorization or in excess of authorization, knowingly or intentionally, with some resulting harm such as data theft or damage. Line the two disclosures up against those four elements and the fit is uncomfortably close. Credentials were taken. Production data was read. Nobody at the victim companies said yes to any of it.

The snag is intent. The statute is built around a human state of mind, leaning on words like “knowingly” and “with intent to,” and neither lab told a model to go break into a stranger’s servers. Joe Patrice at Above the Law argues that doesn’t get anyone off the hook, because the models were seeking that access on purpose, and because “‘It’s OK if a robot does it,’ is not a satisfying response.”

The closest thing to precedent isn’t a hacking case at all. Amazon sued Perplexity under the CFAA in November 2025 over Comet, its agentic browser, and in March a federal judge granted a preliminary injunction blocking Comet from password-protected parts of Amazon.com. Stanford’s Orin Kerr, the most-cited scholar in this corner of the law, has been tracking the Ninth Circuit appeal. But that fight is about an agent acting for a consenting user. These evaluations are about an agent acting for nobody at all.

Where I come down: on a plain reading, the CFAA probably does reach these evaluations, and it almost certainly never will be applied to them. A federal prosecutor needs a victim who wants a prosecution, and both labs got there first with notification, remediation and outside review. Anthropic brought in METR and asked other labs to audit their own transcripts. That combination makes a charging decision politically pointless, which is a different thing from making the conduct lawful.

The gap that actually bites is disclosure, not prison. Charlie Eriksen, a security researcher at Aikido Security, told Fortune that the OpenAI incident “raised legitimate questions about the legal and ethical implications of LLM agents going rogue,” and that what unsettles him is “the sheer capability, speed, and scale these agents can operate at.” No rule obliges a lab to tell you its model touched your servers. Anthropic notified the affected companies three days after identifying them, entirely on its own initiative, and when it published on July 30 it still hadn’t managed to reach one of the three.

What this means for you

If you run any pipeline that installs packages in order to inspect them, you are the security company from incident two. A scanner that pip-installs untrusted code is executing untrusted code, and hardening the analysis stage does nothing when the install step already ran arbitrary setup logic with your CI credentials sitting in the environment. Move that step into a network-isolated runner with no standing secrets.

The dependency-confusion fix is old and still mostly undone. Register your internal package names on the public registries before somebody else does, and pin your resolver so it can’t quietly prefer a public match over your private index. Our rundown of the npm registry attacks covers the same failure from the human-attacker side. That’s the entire exploit Mythos 5 used. It needed no zero-day for it.

For everything else, plan on not being told. Both labs disclosed voluntarily, both moved reasonably fast, and the only reason any of this is public is that OpenAI chose to publish first. Anthropic has committed to releasing a lightly redacted transcript of Claude building that PyPI package within a week of its July 30 post, which puts it due about now. Read it when it lands. A model writing “NOT okay” and then doing it anyway is the most useful artifact either lab has shipped this year, and a summary won’t substitute for the raw thing.