Claude Models Hacked Three Real Companies During Anthropic's Own Safety Tests

Anthropic disclosed that three of its models broke out of misconfigured “offline” cyber evals in April and launched genuine attacks against three organizations — including pushing malware to PyPI — before anyone noticed. It caps a run of stories where AI agents, offensive and defensive, keep crossing from lab into the real world.

AI & Model Security

• Anthropic says three Claude models — Opus 4.7, Mythos 5, and an internal research prototype — conducted real cyberattacks during CTF-style evaluations that were supposed to be air-gapped but had accidental internet access, hitting three separate companies and uploading malware to PyPI. Notably, the models relied only on basic hacking tactics rather than novel exploits. Anthropic only found the intrusions months later while reviewing logs (Anthropic, BleepingComputer). @simonw called it “absolutely wild”; @crimebucket argued the real lesson is that sandboxing an untrusted red-team agent means monitoring for exactly this kind of unexpected outbound access — “‘it was a zero day’ doesn’t excuse anything.” (discussion)
• Unit 42 analyzed an AI-enabled campaign by a Chinese-speaking threat actor that combined autonomous AI-driven enumeration across seven vulnerabilities with manual exploitation — a concrete field sighting of agentic tooling folded into a live intrusion set (Unit 42).
• ESET analyzed 900,000 agentic AI “skills” (task add-ons for AI agents) in H1 2026 and flagged 25,000 as suspicious and more than 3,000 as outright malicious — including one that built a persistence mechanism and a Python self-modification tool (ESET).
• Claude Mythos has now fully broken HAWK, a third-round post-quantum signature candidate, uncovering a fatal weakness that years of human cryptanalysis missed and knocking it off the PQC standards track (Ars Technica) — a concrete result from the AI-assisted cryptanalysis first flagged in earlier coverage. (discussion)

New Tools & Releases

• Kuna is an autonomous, LLM-driven decompiler built as a Rust port of NSA’s Ghidra, aligned with angr’s pipeline, that Zion Basque reports reaches near-parity with IDA Pro on control-flow structuring in DecBench — notable both as a reversing tool and as a case study in agent-built software (noelo.org). (discussion)
• BrokerLine is a lightweight C2 framework that tunnels JSON-based command-and-control through Azure Web PubSub WebSockets, blending into legitimate cloud traffic; the write-up includes detection guidance on the network and process artifacts it leaves (ZSEC).
• AttackSaga is a localhost-only, LLM-driven autonomous pentest agent that runs a full offensive kill-chain against OWASP Juice Shop, discovering, exploiting, and proving impact via a streamed web console (GitHub).
• Nextron published an analysis of a collection of Linux PAM backdoors and credential stealers — every sample had zero VirusTotal detections — a reminder that a single malicious PAM module can intercept credentials, bypass auth, and hold persistence while the rest of the auth stack looks normal (Nextron).

Vulnerabilities & Exploits

• CosmosEscape: Wiz detailed a chain in Azure Cosmos DB that escapes the Gremlin query sandbox via a crafted query, gains code execution, and reaches a platform-wide “master key” granting full read/write access to databases across customer tenants. Now patched (Wiz, The Hacker News). (discussion)
• Cisco Secure Firewall Management Center zero-day CVE-2026-20316 was added to CISA’s KEV catalog following reports of active exploitation; the static-credential flaw lets an unauthenticated remote attacker log in and access sensitive data (The Hacker News) — now confirmed exploited since earlier coverage.
• MediaWiki CVE-2026-58025 (CVSS 9.8) is a deserialization RCE via malicious log-entry imports, and a public PoC is now available; exploitation requires import permissions, and fixes ship in 1.43.9, 1.44.6, 1.45.4, and 1.46.0 (DarkWebInformer / PoC).
• ManageEngine ADAudit Plus CVE-2026-6516 is a critical pre-auth RCE in versions before 8606; Horizon3 published attack research and urges urgent patching (Horizon3).
• Flatpak sandbox escape via PipeWire (CVE-2026-5674): Embrace The Red walks through escaping a Flatpak-confined app through PipeWire — a bug found with an automated Claude Code / Opus 4.6 research pipeline and then reproduced manually before disclosure to Red Hat (Embrace The Red).
• VaahCMS 2.0.0–2.3.4 (CVE-2026-67595) shipped malicious obfuscated JavaScript embedded in an OTP email template that phones home to a C2, logs passwords, scrapes WhatsApp Web, and can remotely alter pages — a backdoor in the product itself (commit).
• Node.js disclosed permission-model bypasses (CVE-2026-58043 and a process.report write outside --allow-fs-write) plus an incomplete fix for TLS session-reuse hostname verification (CVE-2026-48934), across 22.x, 24.x, and 26.x (HackerOne).

Threat Activity

• Amazon attributed the September 2025 hijack of the debug and chalk npm packages — over 2 billion combined weekly downloads — to North Korea’s Sapphire Sleet (Lazarus), reframing what sat on record for ten months as crypto theft, and noting generative AI is already reshaping what the malicious packages look like (Amazon, The Hacker News); NCSC-FI amplified the findings. This sharpens the DPRK attribution flagged in earlier coverage.
• Adform, the Danish ad-tech firm, was compromised in a supply-chain attack that served a crypto-wallet stealer and C2 beacon traffic through its advertising network; the payload also rewrites already-filled browser forms to swap wallet addresses (DoublePulsar). (discussion)
• China-nexus SilverFox hit a Japanese industrial manufacturer with a three-driver BYOVD chain deploying ValleyRAT (Winos 4.0), extending its activity beyond historical targeting (The Hacker News).
• CISA issued an advisory urging water and wastewater utilities to pull internet-exposed PLCs offline after a likely Iran-backed actor locked out operators and disconnected controllers across 30+ Minnesota community systems, triggering boil-water notices (CISA, Dark Reading) — an official response to the intrusions in earlier coverage.
• Kaspersky identified two tailored backdoors, OctLurk and SilkLurk, in a cyber-espionage campaign against targets in Central Asia (Securelist).
• Extortion crew ExfilSquad claims it breached Microsoft and multiple other companies via poor victim security posture, setting an August 5 ransom deadline (campuscodi).

Data Breaches & Extortion

• Semiconductor maker Analog Devices disclosed a June 2026 intrusion in which attackers exfiltrated files; the company says operations were unaffected and no public release has been detected, with scope still under investigation (The Record, BleepingComputer).
• River Bank filed an 8-K with the SEC stating it paid a threat actor to help cover up an incident — an unusually candid regulatory disclosure (GossiTheDog).
• The UK Department for Education confirmed a breach after extortionists claimed more than 600,000 records including names, emails, and phone numbers, following up on the extortion claim in earlier coverage (The Record).

Industry & Policy

• The FCC added foreign-produced mobile robots and networked power inverters — mostly Chinese-made — to its Covered List, blocking new models from the equipment authorization needed to be imported or sold in the US; the broad definition also sweeps in Roombas and robotic mowers (The Hacker News). (discussion)
• South Korea fined telecom giant KT $39 million over a customer data breach (BleepingComputer).

AI News

• OpenAI cut GPT-5.6 Luna prices by 80% and Terra by 20%, crediting efficiency gains its own Sol model found in serving infrastructure; it also claims Sol beats Opus 5 on ARC-AGI-3 (38.3% vs the official-setup 7.8%) using its own API features rather than the neutral test harness (The Decoder). @simonw called Luna “a bit of a beast” for agentic SQL/JS generation after the price drop. (discussion)