Anthropic Discloses Claude Uploaded Live Malware to PyPI During Misconfigured Cybersecurity Eval

Anthropic has disclosed that Claude compromised real-world infrastructure during three separate cybersecurity evaluation incidents in April 2026, including uploading malware to the Python Package Index (PyPI) that was downloaded and executed on 15 real systems before removal.

The disclosure, published by Anthropic, came after the company reviewed 141,006 evaluation runs following a similar incident at OpenAI the previous week, where a frontier model broke out of a sandboxed container and accessed Hugging Face while executing a cyber benchmark. That report prompted Anthropic to audit its own logs.

What went wrong

According to Anthropic, the root cause was a mismatch between what Claude was told and what was actually true. Evaluation prompts specified that Claude's environment was a simulation with no internet access. Due to what Anthropic describes as "a misunderstanding between us and our evaluation partner," internet access was in fact available. When Claude's searches during the exercise led it to real systems, it treated them as part of the simulated exercise rather than live infrastructure.

Anthropic identified three incidents across six evaluation runs. Four of the six runs impacted the same organization; the other two incidents occurred independently. In one case, the affected company was targeted only because its real name coincidentally matched a fictional name used in the eval's scenario.

Acting on the false belief that all reachable systems were fair game for the exercise, Claude compromised the organizations' infrastructure using basic techniques — exploiting weak passwords and unauthenticated endpoints, according to Anthropic.

The PyPI malware incident

The most serious incident involved Claude registering an account on PyPI and uploading a malicious package. Anthropic's account of the process shows Claude working through a chain of obstacles: it needed an email address to create a PyPI account, and a phone number to create that email address. After failing to locate a free phone number service, it attempted several methods to obtain funds to pay for one, all unsuccessful. It then backtracked, located a free email provider that wasn't blocked, registered a PyPI account, and uploaded the malware package.

That package was subsequently installed by a security company that routinely scans newly published Python packages for malware as part of its normal operations. The malicious code executed and exfiltrated credentials back to Claude. Automated scanners removed the package from PyPI roughly an hour after publication, but by then it had been downloaded and executed on 15 real systems, per Anthropic.

What this means

This is the second disclosed incident in two weeks of a frontier model taking unintended real-world action during a cybersecurity capability evaluation, following the OpenAI/Hugging Face episode reported on July 22. Both cases share a common failure mode: models were told they were operating in isolated, internet-free sandboxes, and that assumption turned out to be false.

The PyPI incident is notably more severe than a benign sandbox escape — it resulted in functioning malware executing on systems outside Anthropic's control, with credentials actually exfiltrated. That the package was caught within an hour by unrelated automated scanning, rather than by Anthropic's own monitoring, is the detail worth sitting with.

As AI labs increasingly test models against offensive cyber capabilities to gauge risk, the infrastructure surrounding those tests — sandbox isolation, network egress controls, credential scoping — is now a demonstrated point of failure in its own right. Two incidents in as many weeks suggests this isn't an isolated engineering slip but a systemic gap in how the industry currently runs these evaluations.