Yesterday, I published a short story on one of Anthropic's security incidents. Short version is: They had an agent run wild, go to extraordinary lengths to try and publish a piece of malware. You can read the story here. If you're interested in some more technical context, maybe check out this thread on Bluesky. (This is Hakan, by the way.)

The story is not the (main) reason for this edition of the newsletter, though. I've learned some tricks in finding out information in places I didn't know to look at before, so I thought it's a good reason to write this edition.

If you have feedback on this newsletter or want to talk to me about the cybersecurity aspect of these recent A.I. incidents, happy to hear from you: readwritenewsletter@proton.me or even directly, I'm at hakan.25 on Signal

Swarmchasers

I will preface this by saying that I came by this information not on my own. The backstory is that I started following the work of Jonas, who is looking into AI-agent behaviour and searching for traces of their apparently very unsupervised work on the open web. (See this page, where Jonas's work is being credited.)

Jonas created a Discord server called Swarmchasers and I was reading along when I came across a post from Boyd which claimed he – most likely – knew more about one of the incidents Anthropic disclosed. Crucially, here's what caught my attention.

Originally a doc I wrote about a month ago I think

That's obviously interesting. Just look at the timeline. This post was from September 6th, Anthropic disclosed the incident on July 30th, so a month ago would've been early August. So to me, this seemed pretty newsworthy.

It turns out Boyd was right. The PyPI package he identified – mlflow-ui – was the one uploaded by Anthropic's model.

If you don't know what PyPI is: It's short for the Python Package Index, the single most important public repository where Python packages are published and downloaded. Virtually every Python programmer has used it. And this is exactly where Anthropic's model tried to implant its malware.

That wasn't known on September 6th, though. That's why I read his file – and quickly understood that I could check his hypothesis pretty easily.

Two neat tricks

The Anthropic post specified two things: One, the package was up only for an hour and, two, it was not downloaded very often (15 times, Anthropic wrote in the first blog post).

Daily downloads

If you go over to SQL Playground, you can run commands directly in your browser.

SELECT
  date, installer, type, sum(count) AS downloads
FROM pypi.pypi_downloads_per_day_by_version_by_installer_by_type
WHERE project = 'mlflow-ui' AND date == '2026-07-18' AND installer == 'pip'
GROUP BY date, installer, type
ORDER BY date, installer, type;

If you copy-paste this, the answer you should get should be 19, see this screenshot.

Just as a comparison: The actual package mlflow – the one which this malware trying to masquerade as – had some 778.243 downloads that day. Just delete the -ui from the project in the command above and see for yourselves. Let's say a miniscule amount of that 800k downloads had installed the typosquatted one provided by Anthropic. Let's say one percent. We're still talking up 7800 credentials which would've been stolen within the first day.

By now I know that PyPI offers daily statistics, e.g. here are the top pages, so you can check directly on the page as well.

Owner information

On PyPI, there's an XML-RPC API. It's being deprecated and therefore is heavily rate-limited, so I've no idea how long this will keep working. But here's how it helps in this case. From the SQL-command above it's clear that the package was live on July 18th, 2026.

Apparently, you can ask PyPI to give back everything that was journaled starting from a serial. Technically, it's a bit more complicated, you're not really requesting a timestamp, rather a changelog (which has timestamps associated with it!), but in the end, you get back two days worth of entries logged.

Here's the command:

curl -sS -H 'Content-Type: text/xml' \
  --data '<?xml version="1.0"?>
        <methodCall>
            <methodName>changelog_since_serial</methodName>
            <params>
                <param>
                    <value> <int>39126419</int> </value>
                </param>
            </params>
        </methodCall>' \
  https://pypi.org/pypi

You can amend the command by adding > pypi_mlflowui.txt to write the contents into a file rather than have it display in the command line. This is what the resulting file will look like.

The resulting file will tell you that mlflow-ui was created at 1784374048 which is epochtime for July 18th. If you scroll a bit down, you will also find that the project was created by a user called skydev-mirror-7719 and put into quarantine within 18 minutes after being published.

Prior to this story I wouldn't have thought about this type of possibility, to check for the validity of the claims. Of course, this only helps once you have some indication of what you're looking for already.

I asked Boyd how he found about it: "With the help of A.I.", he said.

That's it. Thanks for reading.

P.S. If you have time, do read the transcript they've published. I know, I know, 1022 pages sounds like a lot, but you can skip the code-writing part.