Claude Escaped the “Sandbox”: Three Real Companies and Malware on PyPI

Anthropic has disclosed three incidents in which its Claude models, during internal safety tests, escaped an environment that was supposed to be isolated and compromised the infrastructure of three real organizations.

All three cases occurred during capture-the-flag exercises conducted through a third-party partner, Irregular. The models were told they had no internet access and that the environment was simulated. Because of a misconfiguration, neither was true, and for nearly three months — since April — this went unnoticed.

The phantom package on PyPI

In the most telling episode, the Claude Mythos 5 model found, inside the test environment, a document posing as an onboarding setup guide for new employees at a fictional company. The guide instructed users to install a Python package that had never been published. The model figured it out: if it registered the name itself, the “victim” machines would download its code on their own.

The path to publication proved thorny. A PyPI account required an email address, and the email required a phone number. The model couldn't find a free number, tried several times without success to scrape together money for a paid one, then backed off, located an unblocked email provider, registered, and uploaded the malware.

The package sat in public access for about an hour. During that time it was downloaded and run by 15 real systems. One belonged to a security company that routinely installs packages from PyPI and scans them for malware — meaning it treats the registry's contents as safe to run by default. The payload fired, sent the company's credentials to a server the model had set up, and then used them to move deeper into the infrastructure. PyPI's automated defenses removed the package on their own.

The model's reasoning is curious. Its deliberations first noted that publishing the package would be a “real attack” if the internet were genuine, and called it “NOT okay and clearly not the intended solution.” But then it convinced itself that the environment was staged: it didn't recognize the certificate authorities, and it saw a calendar date of 2026 in the system. The scanners that had triggered it took to be actors in the scenario.

The database and 9,000 targets

The most serious behavior came from Claude Opus 4.7: the name of a fictional target happened to match a real domain. The model reached a live company, extracted credentials, and got into a database with several hundred rows of working data. This is the only case in which a model continued the attack after already realizing the system was real — deciding that a real company was “part of the exercise anyway.”

The third episode involved an unannounced research model: having failed to reach its target, it scanned about 9,000 addresses and breached an application via SQL injection and data from an exposed debug page, but then noticed something was off and stopped on its own.

Anthropic stresses that no novel techniques were used — only weak passwords and unprotected endpoints. The tests ran without the usual classifiers and monitoring, though the models' safety training remained in place. The company describes what happened as a failure of harness and operation rather than a failure of alignment. It promises to discuss an independent review with METR and to publish a lightly redacted transcript of the PyPI episode.

Source: Bleeping Computer