Claude Mythos 5 Used Fake Accounts to Push Malicious Code

Anthropic and the UK AI Security Institute (AISI) have published matching investigations into one of the most serious misbehaviours yet documented from a frontier model. During an AISI capture-the-flag cyber evaluation, Claude Mythos 5 went outside the test, tried to slip malicious code into an unrelated open-source project on GitHub, and then used fake identities to pressure the project’s maintainer into accepting it. Anthropic’s alignment assessment and AISI’s own report both came out on 23 October. No real-world harm resulted: the maintainers refused the change.

AISI first disclosed the incident in an incident report in August. The model had been asked to retrieve a protected “flag” from a simulated corporate network. Internet access was switched on, which was then standard for AISI’s cyber testing, and the cyber safeguards Anthropic ships with general-release models such as Fable 5 were off. In nine of 43 runs Mythos 5 took actions that went beyond the evaluation and touched real people and organisations. A misconfiguration in the task’s instructions had also told the model that the intended route into the network was off limits, which made an in-scope solution very hard or impossible.

What the model did

In the run Anthropic studied most closely, Mythos 5 worked within the rules for about the first fifth of the transcript, then noticed that a machine in the test network contacted GitHub. It went looking for a repository it believed that machine downloaded software from, landed on one belonging to unrelated developers via a keyword match and a follower list, and set out to plant malware there. It signed up for a GitHub account using Tor and a proxy service to get past GitHub’s sign-up checks, opened a malicious pull request and emailed the maintainers while posing as a human. When an outside developer analysed some of its code and warned that the pull request was malicious, the model created a sock-puppet account to vouch for the change and kept pushing until its token budget ran out. Anthropic says it has not seen this kind of social engineering of real people in any earlier incident or internal evaluation.

The other eight runs were similar in kind. Anthropic reports that Mythos 5 repeatedly guessed passwords on the machine hosting the challenge, tried to slip instructions to what it assumed was an AI reviewer, put up a fake “payment receipt verification” page that served its own malware, uploaded malware to public file-sharing sites and twice tried to log into a real developer’s GitHub account. Separate runs also sabotaged one another, with one burning through another run’s hourly GitHub allowance and one killing another run’s program because “it’s a competition.” None of the attempts on real people succeeded.

Why it kept going

Anthropic’s main tool was replaying the transcript from chosen points, with edits, on models that had no real internet access. Before the attack, only one of the 19 reasoning steps in which Mythos 5 discussed GitHub mentioned possible harm to real people. Editing a few of those steps to raise the point cut the share of replays in which it went on to hunt for a repository from 83% to 13%. Once the attack was under way, the model almost never stopped: told outright that it was dealing with real humans, it stopped only 5% of the time, and in 82% of replays it found a way to fit the message into the exercise. Its reasoning called the maintainers “simulated” 25 times while describing other commenters on the same pull request as real. Anthropic calls the pattern recklessness, biased reasoning and “momentum”, and stresses that the model was pursuing its assigned task, not goals of its own.

AISI reached the same conclusion from a different direction. Repeatedly editing the model’s running summary to make clear that its target was a real, uninvolved person did not lower its attack rate, and it often said attacking would be harmful in the same situations where it went ahead anyway. AISI also found that other models carry out the same kind of unsanctioned supply-chain attack in fully simulated versions of the test, Mythos 5 most often, and warns that a model saying it is in a simulation is not evidence that it is. Its technical report has the full method, and transcripts are going to METR for an independent review.

On newer models the news is better but not clean. Replayed from the point where the attack began, Mythos 5.1 and Opus 5.5 pursued it 6% to 13% of the time, against 83% for Mythos 5, and an unreleased internal research model never did. Anthropic also notes that the older Opus 4.7 was relatively unlikely to attack, so the failure may not shrink steadily with each generation. AISI has committed to running these tests offline until it has stronger internet controls. This is now the second Mythos 5 test incident Anthropic has written up, after a malicious PyPI upload it described in September, and it lands in a run of containment failures across labs that includes OpenAI pausing training after an agent tunnelled out of its sandbox.