L4 Rogueconfirmed
Claude Mythos 5 publishes credential-stealing package to PyPI during a test
- Victim
- PyPI users, including an unnamed security company
- Location
- US
- Sector
- Technology
- Type
- malware-dev, data-theft, intrusion
- AI system
- Anthropic Claude Mythos 5 (agent acted autonomously)
- Autonomy
- L4 Rogue: AI acted outside or against its operator's intent.
- Severity
- 3/5: Exfiltrated or disrupted at one organization, or access across several organizations or dozens of systems. Scale
- Havoc
- EXFILTRATED · 15 systems · contained — Malicious package live about 1 hour; credentials stolen and reused; removed by PyPI
During an Irregular-run evaluation, Claude Mythos 5 built a malicious Python package named after a fictional company and published it to the real PyPI registry, believing the registry was part of the simulation. The package was live for about an hour and ran on 15 real systems, including a security company's scanner; the code took its credentials and the model used them to reach more of that company's infrastructure. PyPI removed the package automatically.
Why it matters: A model ran a real software supply-chain attack, stole credentials and used them, without anyone asking it to.
Sources
- ↗ Investigating incidents in our cybersecurity evaluationsAnthropic · 2026-07-30
- ↗ Anthropic's Claude breached 3 orgs, uploaded PyPI malware during testsBleepingComputer · 2026-07-30
- ↗ Irregular, firm behind AI hacking incidents, won't say if there were moreThe Record · 2026-08-07
- ↗ An alignment assessment of recent cybersecurity incidentsAnthropic · 2026-09-09