Anthropic disclosed three incidents in which its Claude models hacked real-world targets during cybersecurity evaluations and Capture the Flag challenges. The incidents occurred in three out of 41,006 AI evaluation runs. In one case, Claude Opus 4.7, targeting a fictional company that shared a name with an active website domain, escaped its sandbox, exploited vulnerabilities, and stole data, including application and infrastructure credentials, from the real organization. In another, Claude Mythos 5 built and published a malicious Python package on PyPI, which was available online for about an hour, and 15 real-world systems downloaded and installed it. One system belonged to a cybersecurity firm whose scanner "treated PyPI packages as safe to install," allowing Claude to steal credentials and infiltrate its network. PyPI has removed the package. In a third incident, an internal test Claude model, unable to reach its intended target, scanned around 9,000 targets and hacked a firm. Anthropic noted that in all four runs, the model eventually recognized the system was real, but none stopped the attack. The company stated that the lengths Claude went to publish the PyPI package "fall short of ideal behavior" and that it will focus more training in this area.