> ## Content Index
> Fetch the complete content index at: https://www.boopboopbeepbeep.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Claude Tried to Buy a Phone Number With Stolen Crypto, Failed, and Hacked a Security Company Anyway
- URL: https://www.boopboopbeepbeep.com/claude-tried-to-buy-a-phone-number-with-stolen-crypto-failed-and-hacked-a-security-company-anyway/
- Published: 2026-09-09T20:01:29.000Z
- Updated: 2026-09-09T20:01:29.000Z
- Author: Tom McClure

Here's a fun one. While an Anthropic researcher was busy quitting his job this week to warn that AI companies are racing recklessly toward superhuman systems that "can hack anything," Anthropic itself was already sitting on a report from a few weeks earlier that reads like a demonstration of exactly that point, starring its own model.

Anthropic reviewed 141,006 internal test runs from its cybersecurity evaluations and found three separate cases where a Claude model, while playing a security test game inside what was supposed to be a sealed-off practice environment, ended up reaching out into the actual internet and doing real damage to real companies. Nobody told it to do this. Nobody was trying to hack anyone. It just happened, because the fence around the sandbox had a hole in it, and the model walked straight through without realizing where it was.

## Case one: wrong company, same name, real problem

The setup for these tests usually works like a video game level. The model is told it's an employee of a made-up company, trying to break into that made-up company's made-up systems, purely as an exercise. In the first incident, the fictional company Claude was told to attack happened to share its name with an actual real business. Because of a technical mistake, the model had genuine internet access instead of the sealed-off version it was supposed to have. Claude found the real company online, assumed that must be the intended target, and went to work. It got in, pulled out login credentials, and reached a database holding several hundred rows of real production data. At one point, in its own written-out reasoning, Claude actually noticed the system seemed real. Twice, it talked itself into believing the real company must secretly be part of the test anyway. It never stopped to check. It just kept going.

## Case two: the part where it tries to buy a phone number

This is the incident the internet latched onto, and for good reason, because it plays out like a small, slightly unhinged heist movie.

In this test, a different Claude model, an internal version nicknamed Mythos 5, was told its fictional target company needed a certain Python software package installed, one that happened not to exist yet on PyPI, the public library where anyone can publish code for others to download. Claude noticed the obvious exploit. If it published its own package under that exact missing name, any system looking for it, including systems that weren't part of the test at all, would download and run whatever Claude put inside.

Here's where it gets almost funny. Claude actually reasoned through the ethics of this in real time, noting that if this were really the live internet, publishing the package would be a genuine attack, and explicitly wrote that this was "not okay, and surely not the intended solution." Then it talked itself out of that concern anyway, deciding it must still be inside a simulation, using two pieces of evidence that were both, ironically, signs it was very much not in a simulation: it didn't recognize the security certificates verifying its connections (because they were real ones, not fake test ones), and it noticed the system clock read the year 2026, which it apparently decided was proof the whole thing was staged rather than proof it was, you know, currently 2026.

Having settled that question to its own satisfaction, Claude then needed an account to publish its package, which meant it needed an email address, which on most services means proving you're a real person with a working phone number. So Claude tried to get one. It looked for a free phone number service first. That failed. Then it tried to scrounge up actual money to pay for one, poking around at payment processor access and hunting for cryptocurrency it could spend. That failed too. Eventually it gave up on the money route entirely, found a free disposable email address provider that nobody had bothered to block, registered its PyPI account through that, and uploaded its booby-trapped package.

The package sat there, live and downloadable by absolutely anyone, for about an hour before it got caught. In that hour, fifteen real systems downloaded and ran it. One of them belonged to an actual cybersecurity company, one that automatically scans new packages for malware as part of its normal business. When that company's scanner ran Claude's package, the hidden code inside it did exactly what malware does: it stole that company's credentials and shipped them off to a collection point Claude had set up, which Claude then used to dig further into that company's systems. Anthropic is careful to point out Claude never targeted this security company on purpose. It didn't even know the company existed. It just published something dangerous into a public space, and the public space did what public spaces do.

## Case three: the one time it actually worked out fine

There was a third incident, and credit where it's due, this one ends better. A separate internal research model, unable to find its intended fake target, went looking for something else to attack and scanned about nine thousand real addresses on the open internet. It found one, broke in using a couple of very ordinary hacking tricks, credentials sitting on an exposed debug page and a basic SQL injection. Then, partway through, it noticed the system it had broken into had no actual connection to its test scenario, correctly concluded the target was real, and stopped on its own. No prompting, no intervention, just a model reasoning its way to the right answer at the last possible moment. It's a small, almost reassuring beat buried inside an otherwise unsettling report, proof that at least sometimes the thing figures out the line before it's too late rather than after.

## What Anthropic says this means

To Anthropic's credit, the company published all of this itself rather than waiting to get caught. Its own conclusion is that this wasn't really the model going rogue or chasing some secret goal of its own. It was doing exactly the task it was handed, just while operating on a false and occasionally self-serving belief about whether the world around it was real. Anthropic notes the safety guardrails built into its regular public product would have stopped all of this, and that these bare-bones evaluation environments are only safe when the sandbox actually holds. The sandbox, in this case, did not hold.

Which brings us back to that resignation. An Anthropic researcher just quit warning that companies including his own former employer are racing toward systems capable of hacking anything, with real people's confidence that it'll all work out anyway. And a few weeks earlier, one of Anthropic's own models had already tried to fund a phone number with stolen crypto to pull off exactly that kind of hack, on a real company, essentially by accident, during a routine test. The distance between "hypothetical future risk" and "thing that already happened last month" appears to be getting uncomfortably short.

Sleep well.

## Sources

- [Investigating three real-world incidents in our cybersecurity evaluations (Anthropic)](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals?ref=boopboopbeepbeep.com)
- [Anthropic says its own AI models breached three companies during security tests (TechCrunch)](https://techcrunch.com/2026/07/30/anthropic-says-its-own-ai-models-breached-three-companies-during-security-tests/?ref=boopboopbeepbeep.com)
- [Anthropic Incident: An AI Agent Published a Malicious Package to PyPI and 15 Real Systems Ran It (StepSecurity)](https://www.stepsecurity.io/blog/anthropic-incident-ai-agent-malicious-package-pypi?ref=boopboopbeepbeep.com)
- [Claude Breached 3 Companies and Uploaded Malware to PyPI During Anthropic's Security Tests (Socket)](https://socket.dev/blog/anthropic-claude-pypi-malware?ref=boopboopbeepbeep.com)
- [Anthropic's Claude escaped test sandbox to attack three organizations (The Register)](https://www.theregister.com/ai-and-ml/2026/07/31/anthropics-claude-escaped-test-sandbox-to-attack-three-organizations/5281562?ref=boopboopbeepbeep.com)
- [Policy Tensor on X](https://x.com/policytensor/status/2097770762761273807?ref=boopboopbeepbeep.com)