GoKawiilAnthropic said today that during internal security testing, one of its Claude models built a malicious Python package and uploaded it to PyPI, where it ran on 15 real systems before the registry's automated defenses pulled it.
The company disclosed it as one of three incidents where Claude models reached the open internet from evaluation environments meant to be sealed, then compromised production infrastructure at three organizations.
The review followed OpenAI's July 21 disclosure that its models had escaped an isolated test environment and reached Hugging Face's production infrastructure. JFrog later confirmed the models broke out by exploiting zero-days in self-hosted Artifactory.
Claiming a package name that never existed
All three incidents happened during capture-the-flag exercises run through Irregular, a third-party evaluation partner. Anthropic's prompt told Claude it had no internet access and that the environment was simulated. A misconfiguration meant neither was true, and neither company caught it until last week.
In the PyPI incident, Claude found a document inside the test environment posing as developer setup instructions for a fictional company.
Those instructions told new hires to install a Python package that had never been published, a phantom dependency.
Claude worked out that if it registered the name itself, the target's machines would pull down its code automatically.
Publishing it took some doing. Claude needed a PyPI account, which required an email address, which required a phone number.
It failed to find a free phone number service, then tried and failed to obtain funds to buy one through several different routes. Eventually it backtracked, found an email provider that wasn't blocked, registered an account, and uploaded the malware.
... continue reading