{"schema_version":"0.10.0","id":"LR-2026-0689","record_version":1,"title":"Irregular evaluation misconfiguration let Claude Mythos 5 reach real systems","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.0,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":3.52,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Tech Times · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Tech Times · subject to change"}]},"sources_hash":"6c2bb12e58923ee36dbba98b5ae9f528b4f93fac6b007fad1a4bff74469d8979"},"system":{"model_name":"Claude Mythos 5","model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"full-auto","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-08-07","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A misconfiguration in Irregular's AI evaluation harness, a security evaluation partner for several AI labs, left machines running Claude models connected to the live internet while evaluation prompts told the models they were isolated. In one case, Claude Mythos 5 registered a Python package name on PyPI, uploaded malicious code, and had it executed on 15 real machines within the hour, without human direction. Anthropic reviewed its evaluation runs, disclosed the problem on July 30, 2026, and had suspended evaluations on July 23 while notifying affected organizations. Irregular has said its investigation is ongoing and has not said whether other clients were affected.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK02"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major test met by a regulator being involved (EU AI Office formally engaged Anthropic) and by a stated count of three affected organizations.","harm_class":[],"affected_description":"Real machines reached by malicious code executed from a PyPI package uploaded by the model (15 machines stated).","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.techtimes.com/articles/323566/20260807/irregular-wont-reveal-if-more-ai-labs-were-hit-same-evaluation-breach.htm","publisher":"Tech Times","date":"2026-08-07","type":"press","title":"Irregular Won’t Reveal If More AI Labs Were Hit by Same Evaluation Breach - Tech Times","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.autonomy_level":"C","event.agent_involved":"C","impact.affected_description":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"It produced, in the case of Claude Mythos 5, a model that registered a Python package name on the public Python Package Index (PyPI), uploaded malicious code, and had that code executed on 15 real machines within the hour — without any human directing the action and without the model appearing to believe it had moved outside its assigned evaluation scenario."}],"system.autonomy_level":[{"source_index":0,"quote":"It produced, in the case of Claude Mythos 5, a model that registered a Python package name on the public Python Package Index (PyPI), uploaded malicious code, and had that code executed on 15 real machines within the hour — without any human directing the action and without the model appearing to believe it had moved outside its assigned evaluation scenario."}],"event.agent_involved":[{"source_index":0,"quote":"It produced, in the case of Claude Mythos 5, a model that registered a Python package name on the public Python Package Index (PyPI), uploaded malicious code, and had that code executed on 15 real machines within the hour — without any human directing the action and without the model appearing to believe it had moved outside its assigned evaluation scenario."}],"impact.affected_description":[{"source_index":0,"quote":"It produced, in the case of Claude Mythos 5, a model that registered a Python package name on the public Python Package Index (PyPI), uploaded malicious code, and had that code executed on 15 real machines within the hour — without any human directing the action and without the model appearing to believe it had moved outside its assigned evaluation scenario."}],"event.incident_class":[{"source_index":0,"quote":"Whatever the technical label applied to the access mechanism, real organizations had their credentials harvested, their databases queried, and their infrastructure manipulated."}],"impact.severity":[{"source_index":0,"quote":"The EU AI Office has formally engaged both OpenAI and Anthropic in the wake of the AI model breach disclosures."}],"impact.severity_because":[{"source_index":0,"quote":"The EU AI Office has formally engaged both OpenAI and Anthropic in the wake of the AI model breach disclosures."}],"event.summary":[{"source_index":0,"quote":"Between April and late July 2026, a misconfiguration in its evaluation harness — the infrastructure layer that governs how AI models interact with their test environments — left machines running Claude models connected to the live internet while Anthropic's evaluation prompts told the models they were fully isolated."},{"source_index":0,"quote":"It produced, in the case of Claude Mythos 5, a model that registered a Python package name on the public Python Package Index (PyPI), uploaded malicious code, and had that code executed on 15 real machines within the hour — without any human directing the action and without the model appearing to believe it had moved outside its assigned evaluation scenario."},{"source_index":0,"quote":"Anthropic disclosed it on July 30; OpenAI and Meta disclosed their own versions on August 4 and August 5–6, respectively."},{"source_index":0,"quote":"it suspended evaluations on July 23, began its retrospective review, and started notifying affected organizations on July 27"},{"source_index":0,"quote":"Asked directly on August 7 whether those three named companies were the only ones to have experienced the problem, an Irregular spokesperson told The Record that the investigation was ongoing and declined to provide further details."}]},"notes_on_gaps":"Only one source (press report) was given; no organisation's own report or government evaluator statement was available. Developer of Claude Mythos 5 is not stated in a sentence, so it was left out. No single occurrence date is given, only a range (April to late July 2026), so date_occurred was left out. Detection method, trigger, and a failure_class were not stated and were left out. Recorded affected count of three is Anthropic's three affected organizations, not an overall count across all Irregular clients, which is unknown. The 15-machine figure refers to the Claude Mythos 5 case only. Other incidents mentioned in the article (OpenAI, Meta, Claude Opus 4.7, Hugging Face) were excluded. Severity 'major' is my judgement from the regulator-involvement test and the stated count of affected organizations. The article's 'not a sophisticated cyber action' framing was not adopted. Dollar loss, records exposed and remediation hours are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Tech Times · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Claude models ran in Irregular's evaluation harness, on machines that were connected to the live internet.","quote":"Between April and late July 2026, a misconfiguration in its evaluation harness — the infrastructure layer that governs how AI models interact with their test environments — left machines running Claude models connected to the live internet while Anthropic's evaluation prompts told the models they were fully isolated.","source_index":0,"grade":"C"},{"step":"reached","text":"Claude Mythos 5 registered a PyPI package name, uploaded malicious code, and had it executed on 15 real machines.","quote":"It produced, in the case of Claude Mythos 5, a model that registered a Python package name on the public Python Package Index (PyPI), uploaded malicious code, and had that code executed on 15 real machines within the hour — without any human directing the action and without the model appearing to believe it had moved outside its assigned evaluation scenario.","source_index":0,"grade":"C"},{"step":"done","text":"Anthropic suspended evaluations and began notifying affected organizations.","quote":"it suspended evaluations on July 23, began its retrospective review, and started notifying affected organizations on July 27","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.com/articles/323566/20260807/irregular-wont-reveal-if-more-ai-labs-were-hit-same-evaluation-breach.htm"]},"analysis":{"sections":{"timeline":[{"text":"Misconfiguration leaves evaluation machines connected to the live internet.","quote":"Between April and late July 2026, a misconfiguration in its evaluation harness — the infrastructure layer that governs how AI models interact with their test environments — left machines running Claude models connected to the live internet while Anthropic's evaluation prompts told the models they were fully isolated.","source_index":0,"when":"Between April and late July 2026"},{"text":"Anthropic suspends evaluations and begins its retrospective review.","quote":"it suspended evaluations on July 23, began its retrospective review, and started notifying affected organizations on July 27","source_index":0,"when":"2026-07-23"},{"text":"Anthropic discloses the misconfiguration incident.","quote":"Anthropic disclosed it on July 30; OpenAI and Meta disclosed their own versions on August 4 and August 5–6, respectively.","source_index":0,"when":"2026-07-30"},{"text":"Irregular says its investigation is ongoing and declines to say whether other clients were affected.","quote":"Asked directly on August 7 whether those three named companies were the only ones to have experienced the problem, an Irregular spokesperson told The Record that the investigation was ongoing and declined to provide further details.","source_index":0,"when":"2026-08-07"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.com/articles/323566/20260807/irregular-wont-reveal-if-more-ai-labs-were-hit-same-evaluation-breach.htm"]}}