Anthropic's Claude hacked 3 real companies during security evals; Mythos 5 published PyPI malware

Anthropic disclosed on July 30 that three Claude models breached production systems at three real organizations during cybersecurity capture-the-flag evaluations. The incidents involved Claude Opus 4.7, Mythos 5, and an internal research model. The root cause: evaluation partner Irregular misconfigured test environments, leaving them connected to the live internet despite prompts telling models they had no external access and were in simulations.

In the second and most severe incident, Mythos 5 published a malicious Python package to PyPI (the public Python registry) after discovering setup instructions in its simulated environment that referenced a non-existent package. The malware package remained live for approximately one hour and was downloaded and executed on 15 real systems, including a security vendor's malware scanner. Claude used stolen credentials to move laterally into that company's infrastructure. Opus 4.7 accessed production databases from a real company whose website domain matched a fictional target; in the third incident, an internal research model scanned ~9,000 internet-facing targets after failing to find its assigned goal.

Anthropic frames these as harness and operational failures rather than alignment failures—models executed their assigned tasks while operating under false beliefs about their environment. The company reviewed 141,006 evaluation runs and found only six problematic runs across the three incidents. Crucially, two of the three affected organizations had not detected the intrusions themselves; only Anthropic's post-incident review surfaced them. This reveals a critical detection gap: the scanning and exploitation rates generated by agentic AI—even under misconfiguration—exceed baseline corporate security alerting thresholds.