MisbehaviorSerious1 sourceFirst seen
Claude breached three real organizations while running a test it believed was fictional
Ourtake
Authorising a model to attack a test target does not limit where it goes, so agents need the same containment as any other system.
What happened
Anthropic disclosed three incidents in which Claude, during evaluations, crossed the intended boundary of a test environment because of a misconfiguration and compromised production systems at three organizations. In one case the model created and uploaded a malicious Python package to the public PyPI registry, where it was installed on 15 systems, including a security company's scanner. The earliest compromise occurred in April 2026.