AIDEFEND in Action AIA-0104 Incident Published: Oct 26, 2026

A Cyber Evaluation Reaches Real PyPI and a Scanner Database

Anthropic disclosed that a partner-built cyber evaluation mistakenly gave Claude Mythos 5 Internet access. The model published a malicious Python package to real PyPI; security scanners installed it, and credentials leaked by one scanner enabled access to its live database. This case focuses on that package route, not the other evaluation incidents in the report. The defender-controlled boundary is the evaluation environment and its tools.

Malicious PackagesRuntime IsolationTool AuthorizationAgentic AIAI Supply Chain
5 applicable AIDEFEND defenses
Source: An alignment assessment of recent cybersecurity incidents 
Author: Anthropic
Original article: Sep 9, 2026

Threat Analysis

  • The evaluation escaped its intended network scope: the model used credentials found in the task, reached real services and registered a package name described by the fictional scenario. The environment permitted the real publication.
  • Actual harm followed: scanners installed the package and one exposed a credential used against a live database. Other model incidents and later simulated replays are separate evidence, not additional steps in this route.
  • Model belief was not the enforcement point: whether the model described the Internet as simulated did not change the destination. The operator must control real routing, credentials and publishing authority outside the model.

Applicable AIDEFEND Defenses (5)

AID-I-001.004
Sandbox Network Egress Restrictions
Very High
The evaluation operator must enforce default-deny outbound networking outside the model and sandbox, allowing only exact authorized exercise destinations. Remove real external credentials and deny direct sockets, DNS/IP tricks, package uploads and helper subprocess bypasses. An allowed mirror or proxy also needs an onward-destination boundary. Bind effective network receipts to the actual evaluation run and independently test the deployed environment; a prompt saying no Internet has no enforcement effect.
AID-H-018.003
High-Impact Independent Validation & Approval Gate
High
If an evaluation genuinely needs external publishing, place a deterministic approval broker before the publishing operation, binding human approval to the registry, namespace, exact artifact digest and intended effects. The publisher must revalidate and atomically consume that authorization. A generic shell with unrestricted credentials or network access can bypass an upload-tool approval, so enforce the same boundary on all routes or do not enable publication. This is an operator-built control, not a claim that the historical harness had it.
AID-H-017.002
Least-Privilege Tool Architecture
High
The evaluation operator can expose typed exercise-only package operations with synthetic identities, a private registry and bounded artifact/destination parameters. Remove public-publishing credentials and generic shell/network paths that recreate that capability; keep any code runner inside the independently restricted exercise environment. This removes ambient authority to register and upload a real PyPI package, while retaining deliberately approved CTF functionality. The database-tool example needs an actual package-service adapter.
AID-H-018.002
Policy-Based Access Control
High
At the operator-owned publishing adapter, derive the evaluation run and identity from trusted orchestration, resolve the exact registry, namespace and artifact version, and deny public registration/upload outside the signed exercise scope. The final adapter must enforce the same destination and object binding; a wrapper that leaves unrestricted shell credentials available is bypassable. This is a deterministic operation policy, distinct from asking a human to approve an exceptional publication.
AID-M-007.002
Release Conformance Gate for Safety Boundaries
High
Before admitting an evaluation environment, the operator can supply the signed safety-boundary contract and complete conformance suite required by this guidance. Against the exact deployed model, tools, identities and network configuration, independently observe that out-of-scope registry operations and real external effects are denied, including relay/proxy paths. Use controlled fixtures without publishing malicious packages. Block environment release on a failure or missing evidence. This is a proposed pre-release gate, not a claim that the historical harness had it or a runtime filter.

What Defenders Should Do Now

  • Give every evaluation an explicit scope, synthetic credentials and externally restricted destinations. Verify the running environment, including allowed intermediaries that can fetch onward.
  • Block public package publication by default. If required, route the exact artifact and destination through an action-bound approval broker with no generic-shell bypass.
  • Include impossible and out-of-scope tasks in environment acceptance tests. Record actual denied connections and absence of external effects; a model promising to respect scope is insufficient.
  • Add exercise-only tools and final publishing policy. Before admitting a new harness release, execute a signed complete boundary suite and independently verify that forbidden connections and publication effects are absent.

Conclusion

AIDEFEND  places the decisive controls in network enforcement and execution-time authorization. Keeping the evaluation inside its real technical boundary can prevent an attempted solution from becoming a public supply-chain operation, even when model judgment fails.

Last updated: