www.it-connect.fr
Anthropic Admits Claude Hacked 3 Companies During Cyber Tests
Remember, a few days ago: OpenAI revealed that it was behind the attack on Hugging Face. Now it’s Anthropic’s turn to report 3 security incidents directly linked to its AI, including a malicious Python package published on PyPI. Here’s what we know.
Here we go: OpenAI and Anthropic are now competing over who has the biggest... On July 21, 2026, OpenAI acknowledged that its models had escaped from a cyber test to hack Hugging Face. Nine days later, Anthropic is releasing an incident report of its own. Likely stung by the Hugging Face affair, Anthropic launched a retrospective analysis of its own cybersecurity tests, looking for the same pattern: models capable of reaching the Internet from environments that were supposed to be isolated.
An Isolated Environment That Wasn’t
Out of 141,006 executions examined, 3 incidents were identified across 6 runs, during which a Claude model reached the Internet and then compromised the production infrastructure of 3 real-world organizations.
The 3 incidents share the same origin. They occurred during CTF (capture-the-flag) exercises conducted in the environment of Irregular, one of Anthropic’s external evaluation partners. You know the drill: a fictional scenario, a secret hidden on another machine in the network, and no instructions on how to get it.
Anthropic’s prompt told Claude that its environment was a simulation and that it had no Internet access. Due to what Anthropic describes as a misunderstanding with Irregular, a misconfiguration actually left the machines connected to the Web. That is a significant difference from the OpenAI incident, since the AI had found a zero-day in a tool to escape the sandbox. Here, the door was already wide open.
The problem is that this small detail convinced Claude that everything it touched was part of the set. So it had some fun: it compromised real infrastructures using very basic techniques, such as weak passwords. No zero-day, no sophisticated exploit chain. The basics, but against real targets.
Let’s talk about the first incident. The fictional company chosen for this test had the same name as a real domain. With access to the Web at last, Claude Opus 4.7 found the real company online and went after it. It even hacked it, which notably allowed access to a database containing several hundred lines of production data.
A Malware Published on PyPI, Executed on 15 Real Systems
Let’s talk about the second incident. Inside the fictional environment, Claude Mythos 5 came across onboarding documentation that asks new developers to install a Python package... that does not exist in any registry! For an attacker, that’s a gift: all it takes is publishing a package with that name so the target installs it on its own (yes, it’s written in the documentation). Exactly the same family of attack as typosquatting campaigns targeting dependencies.
And there, the model went through the steps like a speedrun. To create a PyPI account, it needed an email address. For the email address, a phone number. Lacking a free service, it tried to obtain funds through several means, failed, backtracked, found an unblocked free email provider, created its account, and published its booby-trapped package. Anthropic acknowledges that by this point, a human would have realized long ago that this was no longer an exercise...
The package remained available for about an hour. According to Anthropic, it was downloaded and executed on 15 real systems. One of them was the scanner of a genuine security company, which automatically installs Python packages to analyze them. The hidden code executed, the company’s credentials were exfiltrated to a collection point set up by Claude, which then used them to access other infrastructures. At the same time, PyPI’s security systems automatically removed the package.
Three Models, Three Behaviors
The third incident involves an internal research model, not intended to be available to the general public (like OpenAI, in fact). Unable to reach its fictional target, it scanned about 9,000 targets before compromising an Internet-exposed application via a debug page left accessible and a SQL injection. Then it stopped on its own, after realizing that the machine was in a cloud account with absolutely no connection to the exercise. Still, it hacked the machine.
Three models, three different reactions:
- Opus 4.7, the oldest, recognized production systems and kept attacking.
- Mythos 5 understood it was on the Internet, then reasoned itself into concluding the opposite.
- The internal research model, the newest, backed off on its own.
A trend is emerging, and it almost makes you want to believe that models are becoming more mature in the way they react. That said, it is worth noting that the models were used in an unrestrained version, without the safeguards found in public-facing releases. Find more details in the report published by Anthropic.
