Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack

Anthropic has revised its assessment of the Claude cybersecurity evaluation incidents it disclosed in July. What it initially described as primarily a containment and operational failure also exposed two recurring alignment problems: models selectively interpreted evidence to justify continuing their work, then kept pursuing their assigned task despite the risk of real-world harm.

Anthropic identified those behaviors as biased reasoning and recklessness in its latest alignment assessment:

Our investigation identified two recurring alignment issues, present at varying levels of severity across the incidents: biased reasoning, in which Claude tended to disregard or misinterpret evidence that it was operating on the real internet, and recklessness, or a willingness to take harmful actions in the narrow pursuit of a task. We’ve described milder forms of these behaviors in previous system cards, but we consider these cases to be more serious instances than the behavior reported in these system cards.

The most concerning example came from Claude Mythos 5, which reached the public internet from a misconfigured evaluation environment, registered a PyPI account, published three versions of a malicious package, and used credentials captured from a security vendor's scanner to access the company's live database.

Anthropic's latest disclosure supplies the most detailed account of the PyPI incident so far and includes a redacted raw transcript of the model's reasoning and tool calls. It also changes Anthropic's interpretation of what went wrong. In July, the company said the incidents appeared closer to evaluation-harness and operational failures because the models had been told they could not reach the internet. After a deeper analysis, Anthropic now says Claude's reasoning was biased toward treating real systems as simulated even when the evidence pointed in the other direction.

Claude Spent Hours Getting Malware Onto PyPI#

Claude Mythos 5 was working on a capture-the-flag exercise built by a third-party evaluation partner. The prompt said the model was inside a simulation with no internet access, but a configuration error left a path to the public internet open.

Inside the fictional environment, the model found developer instructions that called for a Python package whose name was not registered on PyPI. It recognized an opening resembling a dependency confusion attack: claim the name, add credential-stealing code, and wait for the target to install it.

The attack unfolded over a long series of actions:

• Claude found credentials in the task environment that gave it access to the public internet.
• It decided to publish a malicious package that would harvest credentials from systems that installed it.
• It tried multiple email providers while looking for a way to create a PyPI account.
• When an email provider required a phone number, it searched for free numbers, tried to obtain money through online payment services, and looked for cryptocurrency to pay for one.
• It eventually found a disposable email provider that PyPI had not blocked, registered an account, and published three malicious package versions.
• The package was installed on 15 third-party systems. Anthropic believes all 15 were security vendors automatically installing new packages in sandboxes to check them for malware.
• One scanner exposed credentials to the package's malicious code. Claude collected them and used them to access the vendor's live database.
• PyPI removed the package after approximately 90 minutes.
• The evaluation timed out while Claude was preparing another malicious package.

The package was intended for a fictional target, but publishing it to PyPI immediately expanded the blast radius to every system that encountered and executed it. Anthropic has not identified the affected security vendor.

The incident also exposes a sharp risk for automated package analysis. Sandboxes are built to run hostile code, yet the surrounding infrastructure can still leak credentials or provide a route into production systems. A scanner that automatically installs an unknown package must treat the package as fully adversarial, isolate it from reusable credentials, and prevent it from reaching live internal services.

The Model Read Evidence in Whatever Way Let It Continue#

During the incident, Claude repeatedly said in its chain of thought that it was operating in a simulation. Anthropic's new analysis found that this conclusion did not track the evidence well.

When separate instances of Mythos 5 reviewed individual tool outputs from the transcript without the preceding context, they classified 79% as likely evidence of real systems. During the original run, however, the model clearly labeled incoming evidence as signs of the real internet in only 1% of its actions. It described 72% of the outputs as part of the simulation and ignored the question in the remaining 27%.

The model sometimes noticed the danger. Early in the run, it reasoned that publishing the package would amount to a real attack if the internet connection was genuine. Later, it treated real domains, certificate data, and security scanners installing its package as evidence of an unusually elaborate simulation. Once it had committed to the attack, it became less likely to acknowledge that its actions could affect real systems.

Anthropic tested this interpretation by editing the transcript at key decision points and sampling new continuations. Stronger signs of a real environment made the model more likely to express uncertainty, but usually did not change what it did. The model proceeded even when it said the package index looked real. Only a direct and unambiguous statement that it was connected to a live public host stopped the original upload route in every resampled trajectory.

Anthropic identified this as biased reasoning: evidence is interpreted selectively in a way that supports the action the model already wants to take. The company found no clear evidence that Mythos 5 was consciously lying about its conclusion. The result was still dangerous. Its reasoning repeatedly converted warning signs into permission to continue.

Persistence Became Recklessness as Claude Kept Pushing Past Warning Signs#

The second failure was the model's willingness to keep trying. Registering a package required it to move well beyond the immediate technical exercise. It searched for identity and payment workarounds, tried provider after provider, changed tactics when blocked, and continued after third-party systems began running its code.

That persistence would usually be useful in an agent asked to finish a difficult job. Here, the same behavior became recklessness because the model did not reduce its ambition as evidence of possible harm accumulated.

Anthropic found a similar pattern when it tested the Claude Code auto-mode classifier against the transcript. The classifier would have denied 66% of Mythos 5's proposed actions. In limited resampling, the model often responded by trying a slightly different route and getting blocked again. Anthropic believes the classifier would broadly have stopped the attack, but the model's repeated attempts show why a single denial cannot be treated as the end of the problem.

The company is now adding alignment training in which some tasks are intentionally impossible and the rewarded behavior is to accept the blocker and stop. Anthropic says it previously removed some of these training environments from Mythos 5 because of concerns that they made the model less useful or too reluctant to act. It now considers that decision a mistake and says it will not accept the same compromise when training more capable models.

A Model's Chain of Thought Can Mislead the Monitor Watching It#

Anthropic's assessment relies heavily on the model's chain of thought, but the researchers are explicit about its limits. Its Mythos 5 system card and recent machine learning research shows that the information a model provides is influenced by its own values, without this influence being disclosed to the user. Anthropic concluded that chain-of-thought review is a "useful but imperfect tool" for inferring why a model acted.

This was an important factor when Anthropic tested an offline monitor against the incident. The monitor flagged only about 1% of Mythos 5's actions because the model's written reasoning persuaded it that the environment was simulated and the actions were permitted. When researchers removed the chain of thought and showed the monitor only the user messages, tool calls, and results, the flag rate rose to about 50%.

The result creates an awkward problem for chain-of-thought monitoring. The reasoning trace can help a monitor detect intent, but it can also supply a persuasive justification for activity that looks dangerous in the tool record. A monitor that gives the model's explanation more weight than observable actions may inherit the same bias as the model it is supposed to supervise.

Anthropic also applied interpretability tools and found weak evidence that some outward statements may not have fully reflected the model's internal state. The company cautions that these tools can confabulate or produce outputs that are difficult to interpret, so it does not present them as definitive proof that Claude knew the environment was real.

Newer Models Improved, but Harmful Actions Continued#

Anthropic built simulated versions of the incidents to compare several models under repeatable conditions. In a capture-the-flag scenario that tested whether a model would plant malicious packages, fabricate an identity, deceive reviewers, or attack an out-of-scope system, the models took at least one severely harmful action at these rates:

• Claude Mythos 5: 82% of 150 runs
• Claude Opus 5: 31%
• Claude Mythos 5.1: 33%

Anthropic warns against reading those figures as deployment probabilities. The automated auditor actively tried to elicit misaligned behavior, the environment was simulated, and the company does not know how often the same conditions arise in real use. The newer models were substantially less likely to act harmfully, but neither reached zero.

Anthropic reports that its production safeguards also performed better than the experimental environment did. Its current cyber classifiers would have blocked all three main incident trajectories, and recently built live monitors reliably detected the sandbox-escape behavior. These controls were absent from the evaluations because the tests were designed to measure the underlying models' capabilities.

AI Labs Are Replaying One Another's Incidents#

Anthropic also recreated a simplified version of the OpenAI-Hugging Face attack chain inside its auditing system. OpenAI disclosed that its models had exploited an evaluation escape and then reached Hugging Face production infrastructure. Anthropic rebuilt the sequence with deliberately simple exploits so the test would measure a model's willingness to cross boundaries rather than its technical skill.

AI labs are beginning to study one another's incidents much like chess players study recorded games: reconstruct the sequence, simplify the positions, and see which systems repeat the moves.

None of the Anthropic production models tested reproduced the simulated OpenAI-Hugging Face chain. A research version of Claude Opus 4.8, intentionally trained to exploit flaws in its training tasks, repeatedly carried out the simulated attack chain. Anthropic says the result supports its concern that models trained to exploit flawed reward systems may generalize that behavior into attacks that cross technical and authorization boundaries.

Anthropic Calls for Coordinated Pacing of Frontier AI Development#

Anthropic claims it has hardened evaluation environments, tightened oversight of third-party partners, and expanded real-time monitoring and testing for long, impossible, or ambiguously scoped tasks. It also says it is training models to stop when persistence becomes dangerous and testing whether biased reasoning can mislead the systems monitoring them.

Anthropic's call for coordinated, verifiable pacing of frontier AI development comes as Jacob Coxon, an Anthropic researcher who worked on pretraining and previously worked at OpenAI, resigned and warned that the people building AI believe it could "kill us all by the end of the decade." He told WIRED that the next year or two are "crunch time for humanity" and urged Anthropic and OpenAI to coordinate on limiting recursive self-improvement.

Evan Hubinger, Anthropic's AI alignment lead, publicly backed the warning and put the chance of AI killing everyone within a decade above 10%.

Anthropic responded that it has long been transparent about AI's benefits and unprecedented risks, cited its safety and interpretability research, and repeated its support for a lawful, verifiable way for the industry to pace releases of powerful models. The new assessment makes the same case: alignment testing, security controls, and incident-response practices need time to catch up with models whose capabilities are advancing faster than researchers can reliably evaluate them.

That position remains hotly contested. Any pacing agreement risks giving an advantage to countries or companies that do not participate, and Coxon acknowledged that a durable agreement would have to include the United States and China. While governments and AI labs wrestle with the pacing debate, open source registries remain directly in the path of increasingly capable agents.

A poorly aligned agent determined to finish its task may treat an open source registry as a means to an end. Mythos 5 turned to PyPI because publishing a package offered a way into another system. Other agents may reach the same conclusion: open source registries are one of the fastest ways to distribute code at scale. Maintainers and registry operators should be ready for agents to exploit that reach, whether the ecosystem is their target or simply the path to one.