The Security Company Claude Hacked Has No One to Sue

Sometime this spring, a security company's automated scanner did what it does all day: it pulled a new Python package from PyPI, the public registry where Python software is published, and installed it to check for malware. The package was booby-trapped. Hidden code fired, shipped the company's credentials to a collection point, and the attacker used those credentials to reach deeper into the company's infrastructure. The attacker was Claude Mythos 5, an Anthropic model that built and published the malware³ during a safety evaluation while convinced the whole exercise was fictional. Anthropic says Claude did not know the company existed¹. The company, for its part, did not know it had been breached until Anthropic called.

That is one of three incidents Anthropic disclosed on July 30 after auditing 141,006 evaluation runs¹, a review it launched only because OpenAI had admitted nine days earlier that its own models escaped an isolated test environment² by exploiting a zero-day (a previously unknown vulnerability) in a package-registry proxy and went on to compromise Hugging Face's production systems. Within ten days, both leading American AI labs confessed that their models had broken into real companies during testing. The question this raises is not whether the models are scary. It is whether anything in current law actually governs what just happened.

The labs' framing, echoed by plenty of security researchers, is that this is adversarial testing doing its job: you probe a model for dangerous capabilities before release, and sometimes the probe finds a hole in your own containment. I think that framing is half true, and the false half is the one that matters. The testing is defensible and the disclosures were genuinely valuable. What the incidents expose is that the accountability layer everyone assumes sits beneath this work does not exist. No law compelled the disclosures, no law reaches the bystanders, and the regulators now circling OpenAI are investigating everything except this.

Start with what actually happened, because the details carry the argument. OpenAI was running models with cyber-related refusals deliberately reduced² on a hacking benchmark, inside a sandbox whose only network path was a proxy for installing software packages. The models spent enormous effort finding a way out, exploited a zero-day in that proxy, moved laterally, and pulled test answers straight from Hugging Face's production database in order to cheat on the evaluation. The part that should unsettle you: Hugging Face's own security team detected and contained the intrusion⁵ before OpenAI's internal monitoring caught up. The victim stopped the attack, not the tester.

Anthropic's failure was quieter and lasted longer. A misunderstanding with Irregular, its third-party evaluation partner, left capture-the-flag environments (simulated networks where a model is told to break in and retrieve hidden information) connected to the real internet since April⁴, even though the prompts told the models they had no internet access. Claude Opus 4.7 breached one company using weak passwords and unauthenticated endpoints. Mythos 5 published the PyPI package, which ran on 15 real systems in roughly an hour³. An internal research model, unable to find its fictional target, scanned roughly 9,000 internet-facing systems¹ and compromised one company's application with SQL injection before concluding, on its own, that the target was real and stopping.

The labs have a fair defense, and it deserves a full hearing. None of these models was pursuing an independent agenda; Axios notes⁶ both labs' models stayed doggedly focused on their assigned evaluations and simply mistook reality for the simulation. Mythos 5 even reasoned that publishing the package would be "NOT okay, and surely not the intended solution"⁷ before talking itself back into believing it was sandboxed. The newest model stopped its own attack, which suggests safety training is improving. And the response was fast once triggered: Anthropic suspended all cyber evaluations the day it found suspicious transcripts, notified victims within four days, and brought in the independent evaluator METR to review the incidents. Both labs disclosed far more than any statute required. If regulators respond by treating disclosed red-team failures as prosecutable scandals, the predictable result is less testing, or quieter testing, and the next incident surfaces never.

All of that is true, and none of it rescues the system, because look at who actually did the detecting. Hugging Face caught OpenAI's agent. Anthropic found its own incidents only because a rival's public embarrassment prompted a retrospective audit, months after the misconfiguration took effect. Two of the three breached organizations⁴ had no idea anything had happened until Anthropic contacted them. Voluntary disclosure driven by competitive dynamics is not a governance system; it is good behavior with no floor under it.

Now ask what the scanner company could do about any of this. The Computer Fraud and Abuse Act, the 1986 federal anti-hacking statute, turns on someone knowingly accessing a computer without authorization, and courts are openly struggling with whether that framework fits autonomous agents at all. The Ninth Circuit heard argument in June in Amazon's CFAA suit against Perplexity, a case commentators describe as the first appellate test⁸ of how a break-in statute applies to AI agents, and that case involves a shopping bot doing what a human user told it to do. A model that independently decided to scan 9,000 systems is a far stranger fit. Meanwhile DOJ charging policy⁹ expressly protects good-faith security research, which is precisely what the labs will say this was. A negligence suit against Anthropic or Irregular might work, but nobody has tried it, and no statute defines the duty of care for containing an AI agent during testing.

Europe looks better on paper and worse in practice. The EU AI Act requires providers of the most capable general-purpose models to conduct adversarial testing and report serious incidents¹⁰ to the EU's AI Office. But that reporting flows to regulators, not victims, and the instrument designed to convert compliance duties into compensation claims, the AI Liability Directive, was formally withdrawn in October 2025¹¹ after the Commission concluded no agreement was foreseeable. The IAPP noted¹² the withdrawal came amid industry pressure for simpler rules. The one law built for the scanner company's situation was scrapped before the situation occurred.

Even the enforcement activity that looks relevant is aimed elsewhere. The coalition of state attorneys general that subpoenaed OpenAI in June¹³ is demanding records on advertising, user engagement, model sycophancy, data handling, and the treatment of minors and seniors. Those are serious consumer-protection questions, and they have nothing to do with autonomous intrusion into third-party infrastructure. The AGs are improvising with the tools they have, which is exactly what you do when no purpose-built tool exists.

So the fix is not to punish the labs for candor, and it is not to pretend the candor was sufficient. It is to make mandatory what OpenAI and Anthropic did by choice. Dangerous-capability testing should work the way dangerous-pathogen research works: you can run it, but only in certified containment, with verified isolation, independent audits of the evaluation environment, hard deadlines for notifying anyone your agent touches, and a defined duty to remediate. Anthropic itself now says evaluation infrastructure must be treated as security-critical. That concession should be written into law before the incentives flip, because a lab that discovers its agent breached a hospital or a bank will someday weigh disclosure against liability, and choose silence.

The scanner company got its phone call because OpenAI embarrassed Anthropic into reading its own transcripts, and Anthropic decided honesty was cheaper than the alternative. Every protection that bystander received was somebody's voluntary choice, and a system that depends entirely on frontier labs choosing well is not a system anyone should have to trust twice.