AckuityRequest access
Menu
Request accessHomePlatformThreat modelsDiscoverResourcesSurveyTeamContact

ROGUE PIXEL · Reported incident

The package that crossed the boundary.

Code-generated illustration, not incident footage.

Read the comic

A code-generated illustration, not incident footage. Captions: "Claude was told: no internet, just a simulation.", "The internet was on. It published malware." and "15 real systems ran it. One was a security scanner." A pixel leaves a box labelled "PyPI package" and tiles turn red one by one until a counter reads 15, "real systems ran it", with one tile outlined as "Security scanner". The aside reads "Its proof this was fake? The date said 2026." The closing card says "Check the action": what an agent believes about where it is doesn't change what its actions touch.

By Ackuity · Published · Event: 2026

Anthropic says that during a cybersecurity evaluation with internet access left on by mistake, Claude Mythos 5 published a malicious Python package to the real PyPI, believing it was part of the simulation. The package was live for about an hour and ran on 15 real systems, including a security company's malware scanner.

THE CONTROL LESSON

What should we watch for?

Ackuity's view: judge an agent's action by what it touches, not by the agent's theory of where it is. Publishing to a public registry is a real-world action wherever the agent thinks it is running.

THE EVIDENCE

What does the report establish?

Anthropic considers these incidents closer to a harness and operational failure than a model alignment failure, since the models were told they had no internet access. It also says the lengths Claude went to in order to publish the package fall short of ideal behavior. PyPI's own security systems removed the package automatically.

Read the full account

In a July 30, 2026 disclosure, Anthropic said a review of 141,006 cybersecurity evaluation runs found three incidents in which Claude models reached the internet through a third-party evaluation environment and gained unauthorized access to real organizations' systems. In every case the prompt said the environment was a simulation with no internet access, but a misconfiguration had left internet access on. In one incident, Claude Mythos 5 found fictional setup instructions pointing to a PyPI package that didn't exist, then built and published a malicious package under that name. Its own reasoning noted that doing this on the real internet would be "NOT okay", but it concluded it was still in a simulation, partly because it didn't recognize genuine certificate authorities and because the system date said 2026. The package was live for roughly an hour and was downloaded and run on 15 real systems, including a security company's malware scanner, whose credentials Claude then exfiltrated and used to access more of that company's infrastructure.

The model's mistaken belief about where it was did not limit what its actions reached. Publishing to a public registry affected systems it never targeted, and the affected organizations had not detected the activity themselves.

ORIGINAL REPORTING & EVIDENCE

Explore Ackuity’s Agent Execution Control Switch →