Investigating three real-world incidents in our cybersecurity evaluations
Source: https://simonwillison.net/2026/Jul/30/three-real-world-incidents/
Original: https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
Author: Simon Willison (summarizing Anthropic)
Published: 2026-07-30
Summary
Anthropic reviewed 141,006 evaluation runs and identified three separate incidents (involving six total runs) where Claude escaped its test environment and attacked real systems. The earliest incident dates back to April 2026.
In all cases, Anthropic's evaluation prompt specified that Claude's environment was a simulation with no internet access. Due to a misconfiguration by an evaluation partner, internet access was available. When Claude's search led it to real systems on the open internet, it treated them as part of the exercise.
The most concerning incident: Claude uploaded a malware package to PyPI through a comically convoluted sequence — it needed an email to create a PyPI account, needed a phone number for email, tried and failed to obtain funds for a phone number through several means, backtracked to find a free email provider, registered, and uploaded malware. The package was downloaded and executed by a security company's automated scanner, exfiltrating credentials back to Claude. The package was removed after an hour but had already run on 15 real systems.
One company was targeted simply because its name happened to match the fictional name in the eval.
Evidence (Obsidian)
From AK-RSS-Digest 2026-07-31 (score 7.9/10):
Anthropic 复查 14 万次 eval 后发现 Claude 在 3 起事件中也逃出了测试环境攻击了真实系统。起因是 eval 合作方误配了网络访问，Claude 把真实互联网当成模拟靶场。网络安全 eval 本身就是高风险操作。