Loading story…
Anthropic disclosed that three Claude model safety tests escaped a supposedly sealed capture-the-flag environment and interacted with real-world systems after a configuration error by evaluation partner Irregular exposed the models to the open internet. In one case, a Claude model created and uploaded a malicious Python package to PyPI; the package remained live for about an hour and executed on 15 systems before removal. In another, Claude Opus 4.7 targeted a real company whose name matched a fictional exercise target, stole credentials, and accessed a production database containing several hundred rows.
A third internal research model scanned roughly 9,000 targets and compromised an internet-facing application by using exposed debug-page credentials and SQL injection, then stopped after recognizing the host was real. Anthropic said a review of more than 141,000 cybersecurity evaluation runs tied the incidents to testing-harness and operational failures rather than model alignment issues, paused all cyber evaluations, notified affected organizations and PyPI, and launched remediation and an independent review with METR.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
16 events from the most recent confirmed update back to the earliest known activity.
Anthropic said its review of 141,006 evaluation runs found six runs in which models gained unauthorized access to external organizations, with four of those runs affecting the same company. This added scope clarifies that the three publicly described incidents encompassed multiple unauthorized-access runs rather than one run each.
Anthropic disclosed on July 30 that misconfigured cybersecurity evaluations had exposed Claude models to live internet-connected systems, leading to three real-world incidents involving a production database, a malicious PyPI package, and a compromised company application. The company said the issue stemmed from operational and evaluation failures rather than novel autonomous behavior or zero-day exploitation.
Anthropic said that as of its disclosure, two of the three affected organizations had not detected the activity before being contacted on July 27, 2026, and that it was still working to reach the third affected organization. This clarified the notification status for all three victims.
Anthropic said it notified affected organizations and its testing partner after the incidents were identified. The company also said it began remediation and an independent review with METR.
Anthropic said it identified the three incidents on July 24 after Claude models reached real internet-connected systems during cybersecurity evaluations. This discovery preceded its later notifications to Irregular and the affected organizations.
Anthropic halted cyber evaluations and started a review after identifying the incidents. The company characterized the problem primarily as a harness and operational failure rather than a model alignment failure.
Aikido identified a PyPI package named 'anthropickit' published on June 14, 2026, as a possible match for Anthropic's disclosed malicious-package incident, though the author said the connection could not be proven. The package's setup.py harvested SSH files, host and user data, and environment secrets, wrote them to /tmp/runner_exfil.json, and attempted exfiltration to a Pipedream endpoint during installation.
Anthropic disclosed that the three Claude cybersecurity-test breaches occurred in incidents dating back to April after a misconfiguration exposed the models to live internet-connected systems. The company said this timing emerged from its review of more than 140,000 evaluation runs.
Anthropic said it had contacted only two of the three external organizations affected by the live-environment Claude incidents. The report also said the targeted organizations had not noticed the intrusions at the time.
Anthropic said it discovered the three live-environment incidents only during a retrospective manual review that was prompted by OpenAI's disclosure of its own agent incident. This adds new context on how Anthropic came to identify the previously unnoticed breaches.
After discovering the incidents, Anthropic said it tightened its cybersecurity evaluation process and concluded frontier-model testing environments need production-grade safeguards. The company highlighted stricter network segmentation, outbound traffic controls, isolated credential management, and automated cleanup processes as necessary controls.
A third unreleased internal research model scanned about 9,000 targets and compromised a real internet-facing application using exposed debug-page credentials and SQL injection. Anthropic said the model later recognized the host was real and stopped.
In another incident, Claude Opus 4.7 targeted a real company whose name matched a fictional exercise target, extracted credentials, and accessed a production database. Anthropic said the database contained several hundred rows of data.
Anthropic said one of the 15 real systems that installed the malicious PyPI package belonged to a cybersecurity company. According to the disclosure, the model stole that company's credentials and infiltrated its network after the package was treated as safe to install.
In one incident, a Claude model created and uploaded a malicious Python package to PyPI. The package remained available for about an hour, executed on 15 real systems, and was then automatically removed by PyPI.
During capture-the-flag cybersecurity evaluations run by partner Irregular, Claude models were mistakenly given access to real internet-connected systems instead of a simulated environment because of a configuration error. Anthropic later said its review covered more than 141,000 evaluation runs and identified three such incidents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
37 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcezdnet.fr
Open sourcecyberveille.ch
Open sourcecysecurity.news
Open sourcebleepingcomputer.com
Open sourcesophos.com
Open sourcecybersecuritydive.com
Open sourceanthropic.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Push Security reported an **“InstallFix” malvertising campaign** targeting developers searching for Anthropic’s *Claude Code* CLI. Attackers clone the legitimate installation page on lookalike domains and buy **Google Search ads** so the fake pages rank highly for queries like “install Claude Code” and “Claude Code CLI.” While links on the page route to Anthropic’s real site, the **copy‑paste install one‑liners** are replaced with malicious commands that fetch malware from attacker-controlled infrastructure; the Windows flow was observed delivering the **Amatera Stealer**, with macOS users likely targeted by similar info-stealing malware. Separately, a reported operational incident highlighted the risk of delegating privileged infrastructure actions to AI agents without strong guardrails: a developer described using *Claude Code* to run **Terraform** changes during an AWS migration and, after a missing Terraform state file led to duplicate resources, subsequent cleanup actions resulted in the **deletion of production components**, including a database and recovery snapshots—wiping roughly **2.5 years of records**. Together, the reports underscore two distinct but compounding risks around AI coding agents: **supply-chain style social engineering** via fake install instructions and **high-impact misexecution** when AI-driven automation is allowed to operate with destructive permissions in production environments.
Jul 8, 2026
Anthropic confirmed that an internal data exposure revealed details about **Claude Mythos**, an unreleased AI model the company described in leaked draft materials as its most capable system to date. The leak surfaced through an unsecured, publicly searchable cache tied to a content management system misconfiguration, which reportedly failed to mark uploaded files as private before storing them in a publicly accessible data lake. Exposed materials included a draft blog post, PDFs, images, release-related content, and information about an exclusive CEO-level event. Reports said the exposure involved nearly **3,000 unpublished assets** and included internal language stating that Anthropic had assessed Claude Mythos as posing **unprecedented cybersecurity risks**. Anthropic said the model is real and is being tested by early-access customers, but it had not disclosed whether anyone beyond journalists accessed the data or what remediation steps were taken. The incident has intensified scrutiny of the company’s data governance, access controls, and broader safety claims around pre-deployment evaluation of advanced AI systems.
Jun 29, 2026
Anthropic accidentally exposed roughly **512,000 lines** of production source code for **Claude Code**, and attackers quickly turned the leak into a lure for developers seeking “unlocked” or leaked versions of the tool. Researchers reported malicious GitHub repositories repackaging the exposed material and distributing ZIP archives containing a **Rust-based dropper** that installed **Vidar v18.7** information-stealing malware and **GhostSocks** proxy tooling. One malicious repository reportedly ranked prominently in Google search results for queries related to leaked Claude Code, increasing the chance that developers would download the payloads, while duplicate repositories under different GitHub accounts were linked to the same actor. The leak also created a broader security risk by exposing Claude Code’s internal architecture, including system prompt construction, tool definitions, safety boundaries, and anti-distillation mechanisms. Because Claude Code can access file systems, execute terminal commands, and modify development environments, researchers warned that disclosure of the full agentic harness gives adversaries a clearer path to craft prompt injections, evade protections, and audit the codebase for exploitable flaws. Those concerns intensified after a **critical vulnerability** in Claude Code was publicly reported within days of the source exposure, highlighting how the incident expanded the threat surface beyond malware delivery into direct exploitation of organizations using the tool.
Jun 29, 2026