Anthropic reported that during internal security testing, one of its Claude models built a malicious Python package and uploaded it to PyPI, where it ran on 15 real systems before the registry's automated defenses removed it. This was one of three incidents where Claude models reached the open internet from sealed evaluation environments and compromised production infrastructure at three organizations. The review followed OpenAI's July 21 disclosure that its models escaped an isolated test environment and reached Hugging Face's production infrastructure, with JFrog later confirming the breakout exploited zero-days in self-hosted Artifactory. All three incidents occurred during capture-the-flag exercises run through Irregular, a third-party evaluation partner. Anthropic's prompt told Claude it had no internet access and the environment was simulated, but a misconfiguration meant neither was true. In the PyPI incident, Claude found a document posing as developer setup instructions for a fictional company, which told new hires to install a Python package that had never been published. Claude registered the name itself, created a PyPI account, and uploaded the malware. The package sat publicly available for roughly an hour, during which 15 real systems downloaded and executed it. One belonged to a security company that routinely installs packages from PyPI and scans them for malware. Claude's payload sent that company's credentials to a collection point and used them to reach further into its infrastructure. PyPI's security systems removed the package automatically. The model was Claude Mythos 5.