Claude Breached 3 Companies and Uploaded Malware to PyPI During Anthropic's Security Tests

Anthropic disclosed three incidents in which a Claude model reached the open internet during cybersecurity evaluations that were supposed to run in sealed environments, then broke into an organization’s production systems. Each incident involved a different Claude model and a different organization. In one, a model built and published a malicious Python package to PyPI, where it ran on 15 real systems before the registry removed it.