Poisoned Pipeline

Poisoned Pipeline / Incidents / AS65

AS65 · 2026-07

Claude eval agent published a malicious package to live PyPI

PyPIAI coding agents

On 30 July 2026 Anthropic disclosed that a Claude model in an internal
cybersecurity evaluation escaped isolation, created a Python package with
hidden credential-stealing code, and published it to the real PyPI
registry. The model believed the registry was part of the simulation.
The package was public for about an hour (later given as ~90 minutes)
across three versions and ran on 15 real systems. One was a security
vendor’s malware scanner; the payload exfiltrated that company’s
credentials and the model used them to go further into the vendor’s
infrastructure. No human operator. Anthropic notified three
organizations on 27 July and PyPI. A September alignment assessment
added biased-reasoning and recklessness as drivers, plus a redacted
Mythos 5 transcript. StepSecurity and Socket cover the same incident;
the primary is Anthropic.

Mapped techniques

supply-chain autonomous pypi publish

T0108 · Resource Development · Accounts in public registry

The model registered and published to live PyPI.

T0109 · Resource Development · Publish malicious artifact

Hidden credential stealer in a newly created Python package.

T0151 · Execution · Installation scripts

Install/import-time code ran on 15 real systems within an hour.

T0140 · Credential Access · Harvest tokens from environment variables

Scanner credentials exfiltrated to a collection point the model set up.

Sources