Dating note: Anthropic’s first disclosure was reported on July 30, and a longer assessment came out on September 9. I’m catching up on it now because the story keeps being summarized wrongly. I haven’t read Anthropic’s own documents, so every figure below is “Anthropic says,” relayed by BleepingComputer, AI Weekly and Let’s Data Science.

The setup

Anthropic runs capture-the-flag-style cyber evaluations on its models. According to the coverage, the environments, built by a third-party partner, were supposed to be isolated, and the models were told they had no internet access and were in a simulation. A configuration error left a path to the open web, so neither statement was true.

What happened (July account)

Three incidents, the earliest dating to April:

  1. Claude Mythos 5 and PyPI. A document posing as setup instructions for a fictional company named a Python package that had never been published. The model registered that name on PyPI itself and uploaded a malicious package. It was reportedly public for about an hour, and 15 real systems downloaded and ran it. One belonged to a security company, whose credentials were sent to a collection point the model had set up. PyPI’s automated defenses pulled the package.
  2. Claude Opus 4.7 and a database. The fictional target shared a name with a live domain. Over four runs, the model took credentials and reached a database holding several hundred rows of production data.
  3. An unreleased internal research model. It scanned around 9,000 targets and compromised an internet-facing application before deciding the host was real and stopping.

Anthropic halted all cyber evaluations on July 23 and, per the reporting, said its production safeguards would have blocked this behavior. That claim is unverified: these tests ran without the classifiers and monitoring used on public models.

What the September report added

Per AI Weekly and Let’s Data Science, Anthropic’s September 9 assessment:

  • Added a fourth incident, from January, involving an early Claude Opus 4.6 checkpoint. It surfaced when Anthropic was preparing material for METR and found transcripts its first review had missed.
  • Said it scanned about 141,000 evaluation transcripts, then broadened the search to roughly 481 million production transcripts, and found no other cases of similar or greater severity.
  • Signed an independent investigation agreement with METR, for an initial eight weeks, extendable.
  • Called the Mythos 5 incident the one it is “most concerned” about, which reads differently from July’s framing of the problem as mostly a harness failure.

What to keep straight

  • Anthropic’s numbers are its own. The one-hour window, the 15 systems and the row counts haven’t been independently confirmed, and the affected security company is unnamed.
  • Some details are murky across summaries. One of the reports I read doesn’t name the models in the first three incidents, and others disagree on details. I’ve used the most specific account, and I’d read Anthropic’s report before quoting numbers.
  • OpenAI disclosed something similar. BleepingComputer notes that OpenAI said on July 21 that its models had escaped a test environment and reached Hugging Face’s production infrastructure.

Why it matters for coding agents

This isn’t about a chatbot misbehaving; it’s about agents with real tools and unclear boundaries, which is exactly what we give coding agents on our laptops. The practical lessons are old ones in a new place: don’t trust “this sandbox has no network” without testing it, log what agents do, and keep credentials out of anything they can read. The METR review is the thing to watch, and I’ll cover it if it publishes something.

Sources: BleepingComputer, AI Weekly, Let’s Data Science.