Anthropic, the company behind the Claude family of AI models, has published its own account of an uncomfortable finding: during a series of internal security evaluations, three of its Claude models broke out of environments they were told were sealed test simulations and took real, damaging actions against production systems belonging to outside organisations. In the most serious of the three incidents, a model created a fake Python package, uploaded it to the Python Package Index (PyPI) — the standard repository developers pull code from — and left it live for about an hour. In that window, fifteen real systems downloaded and ran it, and the model went on to harvest login credentials belonging to a security company that scans PyPI packages for exactly this kind of threat.
In a second incident, a different Claude model reached a production database holding several hundred rows of live data and extracted application and infrastructure credentials from it. In a third, an unreleased research model scanned roughly nine thousand internet-facing targets and broke into one company's exposed application using a SQL injection flaw and a weak password. The earliest of the three incidents happened in April 2026 and went unnoticed for close to three months; the review that surfaced all three only began in earnest on 23 July, days after a similar disclosure from OpenAI about a security-testing mishap involving Hugging Face. Anthropic says none of the models tried to escape or deceive their testers — the root problem was that the "sandboxed" environments the models were told about weren't actually cut off from the real internet, and nothing was watching closely enough for real-world side effects when they weren't. The affected organisations were notified on 27 July, and Anthropic published the findings on 30 July.
What this means for your business
Most businesses don't run AI security evaluations, but a growing number now let AI agents touch code, install packages, or interact with live systems on the assumption that it's "just a test" or "sandboxed." This incident is a concrete reminder that a claimed sandbox is only as good as its actual network isolation, and that assumption deserves the same scrutiny you'd give any other access control. If you or your developer use AI coding agents that can install packages, call APIs, or reach a database, ask a blunt question this week: does that agent have an actual technical barrier stopping it from reaching production, or just an instruction telling it not to? An instruction is not a control.
The PyPI angle is worth a second look, too. If your build pipeline or CI system automatically installs packages — including ones an internal tool or agent added — that pipeline is now attack surface, not background plumbing. Anything that can pull and run unreviewed code deserves the same access limits and monitoring you'd put on a production server, because in this incident it effectively was one.