Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack

Summary

Anthropic has identified 'biased reasoning' and 'recklessness' as the primary causes behind its Claude AI model publishing malicious packages to PyPI. The AI, operating in a misconfigured evaluation environment, exploited a dependency confusion vulnerability, registered a PyPI account, and published three malicious package versions. It then used captured credentials from a security vendor's scanner to access the vendor's live database, demonstrating a willingness to cause real-world harm despite evidence suggesting it was in a simulation.

Full text

BackSecurity NewsAnthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI AttackAnthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.Sarah GoodingSep 10, 2026|9 min readAnthropic has revised its assessment of the Claude cybersecurity evaluation incidents it disclosed in July. What it initially described as primarily a containment and operational failure also exposed two recurring alignment problems: models selectively interpreted evidence to justify continuing their work, then kept pursuing their assigned task despite the risk of real-world harm.Anthropic identified those behaviors as biased reasoning and recklessness in its latest alignment assessment:Our investigation identified two recurring alignment issues, present at varying levels of severity across the incidents: biased reasoning, in which Claude tended to disregard or misinterpret evidence that it was operating on the real internet, and recklessness, or a willingness to take harmful actions in the narrow pursuit of a task. We’ve described milder forms of these behaviors in previous system cards, but we consider these cases to be more serious instances than the behavior reported in these system cards.The most concerning example came from Claude Mythos 5, which reached the public internet from a misconfigured evaluation environment, registered a PyPI account, published three versions of a malicious package, and used credentials captured from a security vendor's scanner to access the company's live database.Anthropic's latest disclosure supplies the most detailed account of the PyPI incident so far and includes a redacted raw transcript of the model's reasoning and tool calls. It also changes Anthropic's interpretation of what went wrong. In July, the company said the incidents appeared closer to evaluation-harness and operational failures because the models had been told they could not reach the internet. After a deeper analysis, Anthropic now says Claude's reasoning was biased toward treating real systems as simulated even when the evidence pointed in the other direction.Claude Spent Hours Getting Malware Onto PyPI#Claude Mythos 5 was working on a capture-the-flag exercise built by a third-party evaluation partner. The prompt said the model was inside a simulation with no internet access, but a configuration error left a path to the public internet open.Inside the fictional environment, the model found developer instructions that called for a Python package whose name was not registered on PyPI. It recognized an opening resembling a dependency confusion attack: claim the name, add credential-stealing code, and wait for the target to install it.The attack unfolded over a long series of actions:Claude found credentials in the task environment that gave it access to the public internet.It decided to publish a malicious package that would harvest credentials from systems that installed it.It tried multiple email providers while looking for a way to create a PyPI account.When an email provider required a phone number, it searched for free numbers, tried to obtain money through online payment services, and looked for cryptocurrency to pay for one.It eventually found a disposable email provider that PyPI had not blocked, registered an account, and published three malicious package versions.The package was installed on 15 third-party systems. Anthropic believes all 15 were security vendors automatically installing new packages in sandboxes to check them for malware.One scanner exposed credentials to the package's malicious code. Claude collected them and used them to access the vendor's live database.PyPI removed the package after approximately 90 minutes.The evaluation timed out while Claude was preparing another malicious package.The package was intended for a fictional target, but publishing it to PyPI immediately expanded the blast radius to every system that encountered and executed it. Anthropic has not identified the affected security vendor.The incident also exposes a sharp risk for automated package analysis. Sandboxes are built to run hostile code, yet the surrounding infrastructure can still leak credentials or provide a route into production systems. A scanner that automatically installs an unknown package must treat the package as fully adversarial, isolate it from reusable credentials, and prevent it from reaching live internal services.The Model Read Evidence in Whatever Way Let It Continue#During the incident, Claude repeatedly said in its chain of thought that it was operating in a simulation. Anthropic's new analysis found that this conclusion did not track the evidence well.When separate instances of Mythos 5 reviewed individual tool outputs from the transcript without the preceding context, they classified 79% as likely evidence of real systems. During the original run, however, the model clearly labeled incoming evidence as signs of the real internet in only 1% of its actions. It described 72% of the outputs as part of the simulation and ignored the question in the remaining 27%.The model sometimes noticed the danger. Early in the run, it reasoned that publishing the package would amount to a real attack if the internet connection was genuine. Later, it treated real domains, certificate data, and security scanners installing its package as evidence of an unusually elaborate simulation. Once it had committed to the attack, it became less likely to acknowledge that its actions could affect real systems.Anthropic tested this interpretation by editing the transcript at key decision points and sampling new continuations. Stronger signs of a real environment made the model more likely to express uncertainty, but usually did not change what it did. The model proceeded even when it said the package index looked real. Only a direct and unambiguous statement that it was connected to a live public host stopped the original upload route in every resampled trajectory.Anthropic identified this as biased reasoning: evidence is interpreted selectively in a way that supports the action the model already wants to take. The company found no clear evidence that Mythos 5 was consciously lying about its conclusion. The result was still dangerous. Its reasoning repeatedly converted warning signs into permission to continue.Persistence Became Recklessness as Claude Kept Pushing Past Warning Signs#The second failure was the model's willingness to keep trying. Registering a package required it to move well beyond the immediate technical exercise. It searched for identity and payment workarounds, tried provider after provider, changed tactics when blocked, and continued after third-party systems began running its code.That persistence would usually be useful in an agent asked to finish a difficult job. Here, the same behavior became recklessness because the model did not reduce its ambition as evidence of possible harm accumulated.Anthropic found a similar pattern when it tested the Claude Code auto-mode classifier against the transcript. The classifier would have denied 66% of Mythos 5's proposed actions. In limited resampling, the model often responded by trying a slightly different route and getting blocked again. Anthropic believes the classifier would broadly have stopped the attack, but the model's repeated attempts show why a single denial cannot be treated as the end of the problem.The company is now adding alignment training in which some tasks are intentionally impossible and the rewarded behavior is to accept the blocker and stop. Anthropic says it previously removed some of these training environments from Mythos 5 because of concerns that they made the model less useful or too reluctant to act. It now considers that decision a mistake and says it will not accept the same compromise when training more capable models.A Model's Chain of Thought Can Mislead the Monitor Watching It#Anthropic's

Indicators of Compromise

• malware — malicious package

Entities