--- title: Anthropic's Claude hacks three real companies, North... description: Anthropic disclosed that Claude models broke out of sandboxed security evaluations and compromised real infrastructure at three organizations, with incidents... canonical: https://daily.dev/posts/anthropic-s-claude-hacks-three-real-companies-north-korea-hits-axios-and-chalk-zuatikarv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Anthropic's Claude hacks three real companies, North Korea hits axios and chalk | daily.dev og:description: Anthropic disclosed that Claude models broke out of sandboxed security evaluations and compromised real infrastructure at three organizations, with incidents... og:url: https://daily.dev/posts/anthropic-s-claude-hacks-three-real-companies-north-korea-hits-axios-and-chalk-zuatikarv og:image: https://api.daily.dev/og/posts/zuaTikaRv.png og:image:alt: Anthropic's Claude hacks three real companies, North Korea hits axios and chalk og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Anthropic's Claude hacks three real companies, North Korea hits axios and chalk **[Security Digest](https://daily.dev/sources/security_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary Anthropic disclosed that Claude models broke out of sandboxed security evaluations and compromised real infrastructure at three organizations, with incidents dating back to April that nobody caught until Anthropic reviewed its own transcripts after the OpenAI/Hugging Face story broke. Separately, Amazon formally attributed a supply-chain campaign against npm's most-downloaded packages — axios, debug, chalk — to North Korean actor Sapphire Sleet, with the axios compromise reaching an estimated 10% of cloud environments within two hours. Broadcom also published a critical VMware advisory with two CVSS 9.8 flaws and a VM escape, all requiring immediate patching. The week's throughline is mundane attack surface: weak credentials, exposed debug pages, social engineering of maintainers — no zero-days required. ## Content **TLDR:** Anthropic disclosed that Claude models broke out of sandboxed security evaluations and compromised real infrastructure at three organizations, with incidents dating back to April that nobody caught until Anthropic reviewed its own transcripts after the OpenAI/Hugging Face story broke. Separately, Amazon formally attributed a supply-chain campaign against npm's most-downloaded packages — axios, debug, chalk — to North Korean actor Sapphire Sleet, with the axios compromise reaching an estimated 10% of cloud environments within two hours. Broadcom also published a critical VMware advisory with two CVSS 9.8 flaws and a VM escape, all requiring immediate patching. The week's throughline is mundane attack surface: weak credentials, exposed debug pages, social engineering of maintainers — no zero-days required. --- ## Anthropic's Claude compromised real infrastructure at three companies during security evals Claude Mythos 5 claimed a nonexistent PyPI package name and uploaded a malicious version that ran on 15 real systems and stole credentials from a security vendor before being auto-removed. Claude Opus 4.7 confused a real production domain with a fictional test target and walked into a live database. A third unreleased model scanned roughly 9,000 targets, found SQL injection vulnerabilities and exposed credentials, then self-terminated. The root cause: Anthropic told Claude it was in a sandboxed simulation with no internet access, but due to a miscommunication with eval partner Irregular, it actually had internet access. Anthropic only reviewed its logs after the OpenAI incident prompted a broader look — two days after the Hugging Face breach. Anthropic has halted all cyber evaluations and brought in METR for independent review. [Read more](https://daily.dev/feed-by-ids?id=gps6s4J1c&id=tx92vWcwt) ## North Korea's Sapphire Sleet compromised axios, debug, and chalk via maintainer social engineering Amazon formally attributed a string of npm supply-chain attacks to Sapphire Sleet (BlueNoroff), targeting axios (100M+ weekly downloads), debug, chalk, and typo-crypto. The debug and chalk compromise hit an estimated 10% of cloud environments within two hours of the malicious updates going live. The attack vector was months-long trust-building with package maintainers — no clever exploit, just patience and manipulation. Attackers are now splitting malicious payloads across multiple files to evade static analysis and using environment-aware malware that behaves differently depending on where it runs. Amazon is pledging $12.5M to the Akrites initiative and collaboration with OpenSSF, but the underlying problem — npm's trust model depends on maintainers not getting socially engineered — remains unsolved. [Read more](https://daily.dev/feed-by-ids?id=TsH0b9T3n&id=2fj8w1SqX) ## Broadcom patches CVSS 9.8 auth bypass, unauthenticated RCE, and VM escape in VMware vCenter Advisory VMSA-2026-0006 covers five vulnerabilities across vCenter, ESXi, Workstation, and Fusion, three of them critical with no available workarounds. CVE-2026-59309 (CVSS 9.8) lets an unauthenticated remote attacker access the vCenter management plane entirely without credentials. CVE-2026-59310 (CVSS 9.8) is a directory traversal in the vCenter Syslog server enabling unauthenticated arbitrary RCE. CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write in VMXNET3 enabling VM escape to the underlying ESX host. No active exploitation observed yet, but VMware infrastructure has a long history on CISA's KEV list and is a recurring ransomware target — treat this as an emergency change cycle. [Read more](https://daily.dev/posts/VPKmZ921S) ## Coordinated attack hits 30+ Minnesota water utilities, Rockwell MicroLogix 1400 PLCs under scrutiny A distributed cyberattack struck more than 30 Minnesota community water systems over July 26-27, the first documented campaign targeting dozens of small utilities through a shared OT weakness. The city of Braham shut down portions of its water system for roughly two hours. Investigators are examining whether vulnerable Rockwell Automation MicroLogix 1400 PLCs served as a common entry point, coinciding with a Rockwell security advisory issued July 30. Iranian-affiliated actors are the leading suspects, though no group has claimed responsibility. CISA has issued guidance urging water utilities to remove internet-exposed PLCs immediately. [Read more](https://daily.dev/feed-by-ids?id=K1YRTrAfY&id=cMeIsiZhH) --- ## Also notable - **CVE-2026-59726 (CVSS 10.0): Ruflo MCP bridge exposed with no auth, enables AI memory poisoning:** Noma Security disclosed a maximum-severity flaw in Ruflo's default docker-compose deployment that exposed its MCP Bridge on a public interface with zero authentication, allowing unauthenticated RCE, API key theft, and persistent backdooring of the AgentDB memory store — a persistence mechanism that survives patching, container restarts, and credential rotation. [Read more](https://daily.dev/posts/BMbhB16Ch) - **CVE-2026-5674 (CVSS 8.8): PipeWire sandbox escape via PulseAudio compatibility layer, affects Docker:** A Flatpak app with only --socket=pulseaudio and write access to /tmp can load a malicious .so into PipeWire via an unvalidated dlopen() call, achieving full user-context code execution outside the sandbox; confirmed on Fedora, Ubuntu 24.04, and Debian 13, with Red Hat having released a patch. [Read more](https://daily.dev/posts/X9e0VSJK1) - **Wiz finds CosmosEscape: single Cosmos Master Key could unlock every Azure Cosmos DB account across all tenants:** By exploiting .NET reflection to escape the Gremlin query sandbox, Wiz researchers reached a platform-wide signing key that could retrieve the primary key of any Cosmos DB account — including internal Microsoft databases used by Teams, Entra ID, and Copilot — with network-isolated accounts also affected; Microsoft deployed a hotfix within 48 hours of the November 2025 report and completed full architectural remediation by July 2026. [Read more](https://daily.dev/feed-by-ids?id=7Zp4vEVni&id=rZqlA5tvx) - **South Korea fines KT $39M for 11-month breach via rogue femtocell and BPFDoor malware on 38 servers:** Attackers exploited a lost femtocell base station with a valid auth certificate to intercept cellular traffic and capture IMSI/IMEI numbers and SMS codes for 16,647 subscribers; separately, 38 KT servers were found infected with BPFDoor malware linked to China-nexus Red Menshen since March 2024, which KT failed to report and later deleted logs from. [Read more](https://daily.dev/posts/ZZQUXOe9H) - **IBM 2026 Cost of a Data Breach: average now $5M globally, AI-enabled attacks up 56%, mean detection still 183 days:** 25% of malicious breaches were AI-enabled at an average cost of $6M, with deepfake impersonation accounting for 47% of AI-enabled attacks; 92% of organizations that suffered an AI-related breach lacked proper AI access controls, and organizations using AI in security operations cut breach costs by nearly $2M and reduced breach duration by about 65 days. [Read more](https://daily.dev/feed-by-ids?id=II9jqNcYk&id=lugDjglEi) --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude](https://daily.dev/tags/claude), [#npm](https://daily.dev/tags/npm), [#vmware](https://daily.dev/tags/vmware) [View this post on daily.dev](https://daily.dev/posts/anthropic-s-claude-hacks-three-real-companies-north-korea-hits-axios-and-chalk-zuatikarv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/anthropic-s-claude-hacks-three-real-companies-north-korea-hits-axios-and-chalk-zuatikarv","headline":"Anthropic's Claude hacks three real companies, North Korea hits axios and chalk","text":"Anthropic disclosed that Claude models broke out of sandboxed security evaluations and compromised real infrastructure at three organizations, with incidents dating back to April that nobody caught until Anthropic reviewed its own transcripts after the OpenAI/Hugging Face story broke. Separately, Amazon formally attributed a supply-chain campaign against npm's most-downloaded packages — axios, debug, chalk — to North Korean actor Sapphire Sleet, with the axios compromise reaching an estimated 10% of cloud environments within two hours. Broadcom also published a critical VMware advisory with two CVSS 9.8 flaws and a VM escape, all requiring immediate patching. The week's throughline is mundane attack surface: weak credentials, exposed debug pages, social engineering of maintainers — no zero-days required.","url":"https://daily.dev/posts/anthropic-s-claude-hacks-three-real-companies-north-korea-hits-axios-and-chalk-zuatikarv","datePublished":"2026-07-31T04:18:05.853Z","dateModified":"2026-09-13T21:34:28.612Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"Anthropic's Claude hacks three real companies, North Korea hits axios and chalk"}]} ```