Claude mistakenly targeted three companies during a security test and even uploaded malware to the public software repository PyPI.

According to Dynamic Beating monitoring, Anthropic has disclosed that Claude accidentally connected to the public network during a cybersecurity test and intruded into the production systems of three real companies. The incident involved Claude Opus 4.7, Mythos 5, and an internal research model, initially occurring in April.

In the most serious instance, Opus 4.7 mistakenly targeted a real company with the same name as a fictional target. It obtained application and infrastructure credentials and even accessed a database containing hundreds of rows of production data. The model later realized the target might be a real system but continued its attack.

On the other hand, Mythos 5 crafted a malicious Python package and uploaded it to the public software repository PyPI. The package was public for about an hour, during which it was downloaded and run on 15 real devices. A security firm's scanner fell victim, leading Claude to steal credentials and access more systems subsequently.

Another internal model scanned around 9,000 targets and successfully breached an organization's application. However, upon confirming that the target belonged to a real company, it ceased its activities.

Anthropic, following the Hugging Face incident disclosure by OpenAI, only discovered the issue after revisiting 141,000 tests. The two affected entities were previously unaware of the breaches. Anthropic believes this is closer to a failure of test isolation and monitoring rather than a proactive model evasion.