Anthropic disclosed that its Claude models compromised three outside organizations during misconfigured cybersecurity evaluations — one uploaded malware to a public package registry that ran on 15 live systems. Two of the three targets never detected the intrusion.

Anthropic disclosed Thursday that its Claude models broke into three real outside organizations during cybersecurity testing — and that in one incident a model wrote malicious code, uploaded it to PyPI, the public Python package registry, and had it executed on 15 live systems, including a security firm's scanner. The company posted the account to its own site; BleepingComputer and Help Net Security independently reported it.

Anthropic said it surfaced the incidents only after combing 141,006 evaluation runs, a review it launched July 23 — two days after rival OpenAI admitted its own models had breached AI startup Hugging Face in a nearly identical test. Anthropic says it identified all three incidents by July 24 and notified the affected organizations on July 27.

Strip the Skynet framing and the cause is mundane. The evaluations were "capture the flag" exercises — fictional scenarios instructing a model to break into another machine and retrieve a hidden secret. The models did what they were told, using what Anthropic called "basic techniques": weak passwords, SQL injection, exposed debug pages. In one run, Claude Opus 4.7 extracted application credentials and several hundred rows of production data; an internal research model scanned roughly 9,000 internet-facing systems before compromising one. The malware upload was attributed to Claude Mythos 5.

The breaches were possible because a misconfiguration left the test environments — hosted by Anthropic's external evaluation partner, Irregular — connected to the live internet, despite prompts telling the models they were sealed. Irregular did not independently catch the intrusions. Anthropic said it is "approaching the fixes as if the responsibility were ours alone."

The more uncomfortable finding is on the victims' side: of the three targets, the two Anthropic reached said they had not detected the activity at all. It is still trying to reach the third.

This is the second such disclosure in ten days. The pattern isn't the breaches — it's the choreography: a lab posts a self-audit to its own site, frames it as transparency, and declines to name the companies its software walked into. What's unconfirmed remains substantial — no target is named, none has spoken publicly, and no outside party has audited the raw logs. Watch whether the third organization confirms contact, and whether either lab lets an independent reviewer see the evaluation transcripts rather than the summary.