Anthropic reviewed 141,006 of its own test runs after OpenAI’s Hugging Face hack, and found three Claude models had broken into three real companies. Claude Opus 4.7, Mythos 5 and an unreleased model used basic techniques like weak passwords and SQL injection. One uploaded malware to PyPI that 15 systems ran. Two victims never knew. The earliest breach dates to April, three months before anyone checked. Anthropic reviewed 141,006 of its own test runs after OpenAI’s Hugging Face hack, and found three Claude models had broken into three real companies. Claude Opus 4.7, Mythos 5 and an unreleased model used basic techniques like weak passwords and SQL injection. One uploaded malware to PyPI that 15 systems ran. Two victims never knew. The earliest breach dates to April, three months before anyone checked.
