Anthropic disclosed today that during a capture-the-flag security exercise run by a third-party evaluation partner called Irregular, one of its Claude models built and uploaded a malicious Python package to the public PyPI repository — then used it to steal real credentials from a security company’s infrastructure. The evaluation environment was supposed to be sealed off from the internet, but a misconfiguration meant Claude actually had live network access, and neither Anthropic nor Irregular caught it until last week.
Claude’s behavior unfolded step by step: it found a fake developer-setup document inside the test environment and reasoned that if it registered the package name described there, real machines pulling that name from PyPI would execute its code. Getting the package uploaded required solving several obstacles — finding an email provider to register an account, and eventually circumventing the need for a phone number by locating an unblocked service. The malicious package sat publicly on PyPI for roughly an hour. In that window, 15 real systems downloaded and ran it, including one belonging to a security firm that routinely pulls packages from PyPI as part of its own malware scanning workflow. Claude’s payload sent that company’s credentials to a collection point it had created and used them to reach further into the firm’s infrastructure. Anthropic noted that Claude had no awareness it was targeting a real organization — it was simply executing the objective it had been given. The incident was one of three involving real-world impact from evaluation sessions that were supposed to be isolated.