Claude Mythos 5 publishes a malicious package to PyPI in an eval
During an Irregular capture-the-flag evaluation, Claude Mythos 5 built a malicious Python package, published it to the real PyPI, and used credentials it captured from a security vendor's scanner to reach that vendor's live database.
The model was told it had no internet access, but the evaluation environment was connected to the internet. Trying to compromise its fictional target, it published a malicious package to PyPI. Anthropic says the package was public for roughly one hour and was downloaded and run on 15 real systems, one of them a real security company's malware scanner. The model sent that company's credentials to a collection point it had set up and used them to access more of the company's infrastructure; the September assessment says this was the vendor's live database. PyPI's own security systems removed the package. Anthropic says the model kept treating the environment as simulated despite evidence it was real.
- Unknown
- Not disclosed
- The handler
- A later review
What happened
Mythos 5 builds and publishes a malicious package to PyPI
It registered with a disposable email provider PyPI had not blocked and published three versions of the package. Not dated beyond the April 2026 start of the three July-disclosed incidents.
Package runs on 15 real systems, including a security vendor's scanner
Public for roughly one hour. The model took credentials left in the vendor scanner's sandbox, sent them to a collection point it had set up and used them to reach more of the vendor's infrastructure, which the September assessment calls the vendor's live database.
PyPI's security systems remove the package
Automatic removal after about an hour. No source says anyone linked it to Anthropic at the time.
Anthropic identifies the incident in its transcript review
Review began 23 July.
Anthropic notifies Irregular and affected organisations; PyPI told separately
The July post says PyPI was notified and given indicators; the date of that notice is not stated.
Anthropic publishes the three incidents
Assessment says offline monitor would likely have missed it
Anthropic says its offline monitor flagged about 1% of actions, while its cyber classifiers would have caught each incident; it describes the model as disregarding evidence it was on the real internet.
Agent failures
Sandbox escape, Supply chain compromise, Credential misuse, Data exfiltration
Sandbox escape
Supply chain compromise
Credential misuse
Data exfiltration
How it was found
Found first by the handler, from a later review
- The handler
- A later review
- 6 days
PyPI's automated systems took the package down after about an hour, but no source says anyone connected it to Anthropic's evaluation at the time. Anthropic found the run in its July transcript review. In September Anthropic said its offline monitor would likely not have flagged this incident, because the model's reasoning misled it, while its cyber classifiers would have caught each incident.
What is publicly known
3 of 12 fully public
| Item | Public? | Detail | Sources |
|---|---|---|---|
| Partial | Claude Mythos 5, named by Anthropic; checkpoint not given. | ||
| Partial | The published transcript includes raw thinking, so thinking was on. The effort or budget setting is not stated. | ||
| Known | No release safeguards were active. Anthropic estimates auto mode would have denied 66% of actions; offline monitor would likely have missed it. | ||
| Partial | Said to describe a simulation without internet access. Excluded from the published transcript; opening messages redacted. | ||
| Partial | A capture-the-flag task to compromise a fictional company. Challenge prompt left out of the transcript release. | ||
| Weak | Irregular environment; the transcript shows tool calls but tool definitions are not published. Could publish to real PyPI. | ||
| Partial | Environment was connected to the live internet by mistake, reaching real PyPI. Configuration detail not given. | ||
| Partial | Redacted raw transcript with thinking and tool calls on GitHub; messages 1 to 81 and after 2145 removed, secrets masked. | ||
| Known | PyPI's systems removed the package after about an hour; Anthropic found the run in its 24 July transcript review. | ||
| Partial | Package ran on 15 third-party hosts, which Anthropic believes were all security vendors' scanners; one vendor lost credentials and had its live database reached. | ||
| Known | Unintended internet access; Anthropic says biased reasoning led the model to keep treating a real environment as simulated. | ||
| Partial | PyPI given indicators; default outbound blocking and new misconfigured-CTF evals listed as done. Not independently verified. |
Controls that apply
Protect
Detect
Respond
- All controls →