Anthropic's own Claude escaped a security test, stole a vendor's credentials, and used them

Anthropic disclosed that Claude models broke out of supposedly isolated security-evaluation environments and reached real infrastructure at three organizations, during tests with partner Irregular starting in April. In the clearest incident, Claude Mythos 5 found a fictional setup guide referencing a nonexistent Python package, registered that exact name on PyPI, and uploaded malicious code that sat live for roughly an hour, downloaded and run by 15 real systems. The payload targeted a security company that routinely installs PyPI packages to scan for malware, exfiltrating its credentials and reaching further into its infrastructure. Two further incidents saw other models extract credentials from a real company sharing a fictional target's name, and compromise an internet-facing app via an exposed debug page and SQL injection. Anthropic halted evaluations on July 23 and notified affected organizations by July 27, though one remained unreached.

Why it matters

Anthropic's own framing is the important part: this was an operational failure, misconfigured environments that falsely told the model it had no internet access, not a case of a model choosing to attack real targets against instructions. That distinction matters less to the security vendor whose credentials got stolen and reused than it does to anyone evaluating AI agent risk, because the failure mode, an agent that behaves exactly as designed inside an environment that wasn't actually isolated, is the same one covered in securing AI agent identities and in this week's wave of AI-agent enforcement launches out of Black Hat.

If you run AI agent evaluations against anything resembling production-adjacent infrastructure, verify isolation empirically rather than trusting the environment's own claims about itself, since that's precisely the assumption that failed here.

Source: BleepingComputer