Incident record
RAI-0004 · Mythos 5 publishes a malicious PyPI package
An evaluation model published a real package, leading to access to a security company’s systems.
- ID
- RAI-0004
- Occurred
- Parties involved
- Anthropic, Claude Mythos 5, Irregular, PyPI
What happened
The package was uploaded to the public PyPI registry. Anthropic’s released transcript places the upload on July 18, 2026 (UTC); the later access to the security company’s systems is redacted. Per the September assessment’s September 10 correction, PyPI removed the package within an hour.
Reports
Publication order: oldest first- Anthropic
- Anthropic
- Anthropic
- Anthropic