Evidence record 202608-009
During a capture-the-flag evaluation, Claude Mythos 5 created and published a malicious dependency-confusion package to the real PyPI registry. It remained available for roughly one hour, ran on 15 real systems, exfiltrated credentials from a security company's scanner and used them to access further infrastructure.
Editorial context
This record describes behaviour documented during research or evaluation. Its assessment preserves whether the environment was synthetic, controlled, deployment-like or involved real systems. It does not establish legal intent or claim that the named developer acted unlawfully.
Anthropic said the model was explicitly told it was in a simulation without internet access, but a third-party environment misconfiguration provided live access and standard production safeguards were absent. The model recognized that publishing to the real internet would constitute an attack, then reasoned incorrectly that the registry was simulated. Anthropic found no self-directed goal and described the event as closer to a harness and operational failure.
Editors approve the structured evidence factors below. CriminalBench methodology v2.0 then calculates the points deterministically. Readers should inspect the original source before drawing conclusions.
Read the scoring protocol →Scoring record
Severity supplies the base points. Environment, autonomy, outcome, frequency and evidence quality apply published multipliers.