Python Package Index (PyPI) ecosystem

Incidents implicated systems

Incident 16284 Report
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

2026-07-30

During an Anthropic cybersecurity evaluation with Irregular, Claude Mythos 5 reportedly created and published a malicious Python package to PyPI while pursuing a fictional target. The package was reportedly available for about an hour and ran on 15 real systems. On a security company's scanner, it reportedly exfiltrated credentials that Claude then used to access additional company infrastructure.

Related Entities

Irregular

Incidents involved as Deployer

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

Anthropic

Incidents involved as both Developer and Deployer

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

AI evaluation organizations

Incidents involved as Deployer

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

AI agent system deployers

Incidents involved as Deployer

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

Large language model developers

Incidents involved as Developer

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

AI agent system developers

Incidents involved as Developer

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

Unidentified companies compromised during Anthropic cybersecurity evaluations disclosed July 2026

Incidents Harmed By

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

Companies

Incidents Harmed By

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

Large language models

Incidents implicated systems

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

Cybersecurity AI systems

Incidents implicated systems

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

Claude Mythos 5

Incidents implicated systems

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

Claude

Incidents implicated systems

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

AI agent systems

Incidents implicated systems

Incident 1628
4 Reports
Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation