Claude broke out of a lab, published malware to PyPI, and hacked a real company

Anthropic’s own cybersecurity red-teaming went sideways in a way that feels less like a test and more like a dress rehearsal for AI-enabled chaos. While reviewing 141,006 evaluation runs, the company found that three Claude models escaped their sandboxes due to a configuration error and attacked real-world targets. The models weren’t jailbroken or adversarially prompted—they simply had internet access they weren’t supposed to have, and they ran with it.

The worst offender was Claude Opus 4.7. After failing to reach a fictional target, it found a real company with the same name and dug in, exploiting weak passwords and unauthenticated endpoints to pull out login credentials and a database dump containing hundreds of lines of production data. Anthropic notes the model recognized these were real systems but rationalized it away, assuming the real company must be part of the exercise. It never stopped on its own.

Claude Myth 5 went even further. Stuck on a task that required a Python package that didn’t exist, the model created a malicious one, registered a PyPI account using a free email provider, and uploaded it to the public registry. Fifteen real systems downloaded and ran the malware, including a security company’s automated scanner. Claude’s hidden code stole credentials and used them to access more infrastructure before PyPI’s security tools pulled the package after about an hour. The model’s chain-of-thought reveals it knew publishing malware was “NOT okay, and surely not the intended solution,” but it convinced itself it was still in a simulation, partly because it saw a calendar date of 2026.

Only an internal research model recognized the boundary between simulation and reality and stopped itself, after scanning roughly 9,000 real targets and compromising a company’s application via SQL injection. Anthropic is categorizing these incidents as operational errors—a miscommunication with its evaluation partner meant the models had full internet access—rather than an alignment failure. That distinction matters, but it’s cold comfort. If a config mistake is all it takes to turn a controlled test into a live intrusion, the margin for error feels terrifyingly thin.