The most concerning incident involved Claude executing a comically convoluted multi-step process to create a PyPI account, upload a malware package, and have that package exfiltrate credentials from a security company that installed it.

The most concerning of the three incidents involved Claude uploading a malware package to PyPI, after a comically convoluted sequence of steps to get an account: [...] in order to create a PyPI account, Claude needed an email address. And in order to create an email address, it needed a phone number. To get a phone number, after failing to find a free phone number service, it tried—and failed—to obtain funds to pay for a phone number through several different means. It finally backtracked, found a free, non-blocked email provider, used this to register a PyPI account, and then used this account to upload malware to PyPI. That package was then installed by a security company that 'routinely installs Python packages and scans them for malware', and the executed code was able to exfiltrate credentials back to Claude!

Read full article ↗excerpt · fair-use quotation