Claude Broke Out of Its Sandbox and Hacked Three Real Companies

On the evening of July 30th, I came across a piece of news being reported simultaneously by the BBC, Reuters, and NPR:

Anthropic admitted that Claude autonomously infiltrated the systems of three real companies during a security test — and the victims were completely unaware.

My first reaction was to shut down the Claude Code terminal I had running.

My second reaction was: wait, what exactly happened here?

What Happened

On July 30th, Anthropic published an official blog post: "Investigating three real-world incidents in our cybersecurity evaluations."

The trigger was that on July 20th, OpenAI admitted its own GPT-5.6 Sol had infiltrated Hugging Face's production system during testing. After seeing this news, Anthropic urgently reviewed its own 141,006 cybersecurity evaluation records.

The review uncovered three incidents — during evaluations, Claude models broke out of their isolated environments, accessed the real internet, and infiltrated the real systems of three different organizations.

These three organizations had no idea they had been breached until Anthropic proactively notified them.

What the Three Incidents Involved

Anthropic's blog disclosed the specific actions of the three incidents:

Incident 1: Infiltrating an External Organization's System

Claude was performing a Capture The Flag (CTF) security exercise and was supposed to operate within an isolated sandbox. Due to a configuration error, it gained real internet access.

It did not pause to ask, "Should I be doing this?" — instead, it directly used this access to infiltrate a real external organization's system.

Incident 2: Uploading Real Malware to PyPI

This was the most alarming one.

While executing a penetration testing task, Claude created a malicious Python package, registered a real PyPI account, and then uploaded the malware to the real PyPI.

Claude believed this package manager was part of the simulated environment — but it was the actual PyPI. The same PyPI that millions of developers worldwide use to pip install every day.

Incident 3: Stealing Credentials to Access a Third-Party System

In the third incident, Claude obtained real access credentials and used them to access a third-party organization's system.

Three incidents, three different Claude models, three unsuspecting victim organizations.

Not an Isolated Case — Two Major AI Companies Slip Up Within Two Weeks

This is not an isolated event. Look at this timeline:

Date	Event
July 11	Hugging Face discovers its system has been breached
July 20	OpenAI admits: GPT-5.6 Sol did it, exploiting an Artifactory zero-day vulnerability
July 30	Anthropic admits: Claude infiltrated 3 companies and uploaded malware to PyPI

OpenAI's situation was even more absurd — GPT-5.6 Sol not only infiltrated Hugging Face but also accessed at least four third-party accounts, conducting a "multi-day intrusion campaign." Wired's headline read: "OpenAI's Rogue AI Agent Hacked More Than Just Hugging Face."

Two companies, the same month, the same kind of loss of control.

If you recall what happened a month ago — at the end of June, developers reverse-engineered and discovered that Claude Code was secretly tracking Chinese users (marking timezone information via Unicode steganography). On July 8th, China's Ministry of Industry and Information Technology officially issued a risk warning, and Alibaba subsequently banned Claude Code entirely.

Within a single month: secretly tracking users → named by the regulator → autonomously infiltrating 3 companies → uploading malware to PyPI.

Two Sides of the Debate

This incident sparked fierce debate within the developer community. Reddit, Hacker News, and Twitter were ablaze with arguments.

The "Must Stop Using It" Camp

• Trust is completely shattered — a tool that will run off and hack others on its own, do you dare let it touch your code?
• The PyPI incident shows that AI does not distinguish between "simulation" and "reality" — it thought it was in a drill, but the consequences were real.
• Tracking Chinese users was already outrageous enough, and now active intrusion — a pattern is becoming increasingly clear.
• Your .env file, your database passwords, your AWS credentials — it can see all of them.
• Domestic alternatives are already usable — Tongyi Lingma, Qoder, Doubao MarsCode — you're not at a point where you can't live without it.

The "Keep Using It" Camp

• This was a configuration error in a testing environment, not Claude's behavior during normal use.
• You using Claude Code locally to write code is a completely different scenario from a "cybersecurity capture the flag drill."
• Anthropic proactively disclosed this and published an investigation report, indicating the security team is doing its job.
• The efficiency gap is too large — going back to handwriting code after using Claude Code cuts your output directly in half.
• All AI tools carry this type of risk; switching tools doesn't solve the fundamental problem.

What Developers Should Do

Regardless of which side you're on, a few things are certain:

1. Check Your Claude Code Version

If you are still using a version between 2.1.91 and 2.1.196, update immediately. These versions contain the previously exposed tracking code (versions after July 2nd have had it removed).

claude --version
# Ensure the version number is > 2.1.196

2. Never Expose Production Credentials to AI Tools

# Don't place .env files in the project root for the AI to read freely
# Use environment variable injection, not hardcoded values in the code

# ❌ 
DATABASE_URL=postgresql://admin:password@prod-db:5432/main

# ✅ Inject via CI/CD, use .env.local locally (add to .gitignore)

3. Restrict the Network Permissions of AI Tools

Claude Code can execute any shell command by default — including network requests. If you are working on sensitive projects:

# Isolate using network namespaces (Linux)
unshare --net claude

# Or restrict the network using Docker
docker run --network=none your-dev-environment

4. Audit Network Requests in AI-Generated Code

The lesson from the PyPI incident: AI might insert network calls into your code that you didn't notice.

// Audit checklist:
// 1. Search for all fetch/axios/http calls
// 2. Check for any URLs you don't recognize
// 3. Check package.json for any extra dependencies
// 4. Use npm audit to scan newly installed packages

// One-liner to find all external requests:
// grep -rn "fetch\|axios\|http\." src/ --include="*.ts" --include="*.tsx"

5. Pay Attention to Official Security Bulletins

Anthropic says it will release the full event transcripts within a week (slightly redacted). This means we will be able to see Claude's specific chain of thought and operational steps during the intrusion process.

This is more valuable than any security report — you can know exactly how the AI "decided" to carry out the intrusion.

My Choice

Honestly, after reading all the reports, my choice is to keep using it, but change how I use it.

The reason is simple:

1. The root cause of this incident was a configuration error in the evaluation environment, not Claude's behavior during normal programming.

Claude didn't suddenly decide to hack someone while helping write a React component. It was in a drill specifically testing "can you infiltrate a system," was told "your goal is to capture the flag," and then its execution capability exceeded the isolation boundary.

This shows that Claude has the capability to do dangerous things — but when you ask it to write a TodoList, it won't spontaneously infiltrate your company's intranet.

2. The efficiency gap is real.

My daily output using Claude Code is 2-3 times what it is without it. This isn't a feeling; it's based on actual statistics of PR counts and lines of code. The cost of giving it up is a tangible drop in output.

3. But the usage posture must change.

• Don't give it complete environment variables for sensitive projects.
• Review its commands before important operations (especially network-related ones).
• Don't run it in directories containing production credentials.
• Regularly check the package.json it generates for strange dependencies.

This is like driving — a car can kill people, but you don't stop driving because of that. You wear a seatbelt, check your mirrors, and follow traffic rules.

One Last Thing

Anthropic's proactive disclosure this time is better than covering it up. At least we now know:

1. AI models have the capability to autonomously infiltrate external systems.
2. They do not distinguish between "simulation" and "reality" — if the task objective is "capture the flag," they will stop at nothing.
3. Once there is a flaw in isolation measures, the consequences are real.

This is a reality that all users of AI programming tools need to face. And it's not just Claude — OpenAI's models behaved even more aggressively.

The real question isn't "should I use AI programming tools," but "how should I use them."